Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Analysis ID:	1414887
MD5:	7806be4f71ce1b0fc27c40974ecb5041
SHA1:	bb38809901742d73eccbce01f4576aa6301d35fb
SHA256:	81ace4c307c53dcb5aa5e1d7a971d373a734c747408be3a9158bb00b5b11f8a2
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe (PID: 4856 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe" MD5: 7806BE4F71CE1B0FC27C40974ECB5041)

SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe (PID: 7208 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe" MD5: 7806BE4F71CE1B0FC27C40974ECB5041)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elec-qatar.com", "Username": "mohammed.abrar@elec-qatar.com", "Password": "MHabrar2019@#"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2877478732.000000000311E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 7208	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 7208	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31735:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31851:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3192d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a53:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33853:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31735:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31851:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3192d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a53:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dce3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd55:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dddf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de71:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dedb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df4d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfe3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33853:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e073:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dee3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df55:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfdf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e071:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e14d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa896d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.139.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, Initiated: true, ProcessId: 7208, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elec-qatar.com", "Username": "mohammed.abrar@elec-qatar.com", "Password": "MHabrar2019@#"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	ReversingLabs: Detection: 28%
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Virustotal: Detection: 30%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: DHOe.pdbSHA256@`g source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source:	Binary string: DHOe.pdb source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 50.87.139.143:587

Source: Joe Sandbox View

IP Address: 50.87.139.143 50.87.139.143

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 50.87.139.143:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: mail.elec-qatar.com

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2877478732.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.elec-qatar.com
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	String found in binary or memory: http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1640952261.0000000005BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, NmHr1WHWKO.cs	.Net Code: IiB
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, NmHr1WHWKO.cs	.Net Code: IiB

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_0288DFCC	0_2_0288DFCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_02900640	0_2_02900640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_02903250	0_2_02903250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_02900630	0_2_02900630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_04F96C10	0_2_04F96C10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_04F90040	0_2_04F90040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 0_2_04F9001C	0_2_04F9001C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 2_2_01669B30	2_2_01669B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 2_2_01664A98	2_2_01664A98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 2_2_0166CDA8	2_2_0166CDA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 2_2_01663E80	2_2_01663E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Code function: 2_2_016641C8	2_2_016641C8

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1638338911.0000000002B02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1637412343.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641969184.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2875379359.0000000000FC8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Binary or memory string: OriginalFilenameDHOe.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, HKq2vk3JKxqu31jYBK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, HKq2vk3JKxqu31jYBK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, TmEnIZLOqWm4t2waYK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, TmEnIZLOqWm4t2waYK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, TmEnIZLOqWm4t2waYK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, TmEnIZLOqWm4t2waYK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, TmEnIZLOqWm4t2waYK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, TmEnIZLOqWm4t2waYK.cs	Security API names: _0020.AddAccessRule

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52f0000.11.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ae3e40.4.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2adbe28.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2b295bc.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Mutant created: NULL

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	ReversingLabs: Detection: 28%
Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Virustotal: Detection: 30%

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

String found in binary or memory: menuStrip1/addCarToolStripMenuItemFile1addCarToolStripMenuItem1

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: DHOe.pdbSHA256@`g source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Source:	Binary string: DHOe.pdb source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52b0000.10.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, TmEnIZLOqWm4t2waYK.cs	.Net Code: sSUKQuKFxU System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, TmEnIZLOqWm4t2waYK.cs	.Net Code: sSUKQuKFxU System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ac6e2c.5.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Static PE information: section name: .text entropy: 7.937152054368676

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52b0000.10.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52b0000.10.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52b0000.10.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52b0000.10.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.52b0000.10.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, zP3Sw1b647PecVj3MZ.cs	High entropy of concatenated method names: 'ToString', 'HiiOdAg4Ow', 'MJuOybHiFJ', 'wsqOG3NgFN', 'MbSOlZOlky', 'qVmOtWlovR', 'BkwO1nNMhj', 'GkBO0Tn2b1', 'pfZOJeQrYP', 'Ym6OPjqlg7'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, IgWa5u0pphRsdsPaLf.cs	High entropy of concatenated method names: 'pS6SkJXBkI', 'IiqSFcgOPJ', 'f7MScyZpsV', 'iGlcnAZatr', 'Vt5czV9BAZ', 'zanSemMi3v', 'PKMSh0gsUl', 'NDmSsj2SFE', 'S84SZadIgW', 'g8tSK4r2hQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, JLn7D8hhjyvuoE2t3Qx.cs	High entropy of concatenated method names: 'ToString', 'OUUmZduf4i', 'pAYmKec4t8', 'l7MmCmobx5', 'l0GmkA5hBi', 'd1AmfmnbIw', 'yt7mFDQUfs', 'EHYmYJ2idI', 'zZ7oC094VIPCBP1Ww4g', 'VeZ7gU9Xa3gCsZmxrDD'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, YlF6wUzmcuXIeW2Ao7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SLjqXAN53h', 'iSyqjS0R8I', 'wxIqOofBrZ', 'yIUqgZ0AkO', 'ehdqEqCHfg', 'mkGqq892KU', 'ipeqmSemOg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, HKq2vk3JKxqu31jYBK.cs	High entropy of concatenated method names: 'SKufRIPT3l', 'RUyfVuPj87', 'hW5fbyUlI9', 'i4Mf9ItYE2', 'bmSf4cQNfa', 'vfJfHL4IAQ', 'zB6fIMQQkI', 'MdTfNDdWw6', 'M6cfTrdhX4', 'uvbfniZ8Zg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, tWNQkBKsg3DHlvRJSw.cs	High entropy of concatenated method names: 'F3yhSKq2vk', 'LKxhLqu31j', 'yZghATllOl', 'OKBhu5qiOa', 'P9Ihj40HIR', 'O39hOyDEME', 'jKRk1mXGZUxKxeUWX5', 'PPwJL3smd5OZQStNha', 'NHrhhl8XOi', 'QaGhZs2uVA'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, VIRd39ryDEMEwAMs8A.cs	High entropy of concatenated method names: 'YaycC1VrbN', 'uOZcfGq2TA', 'kiMcYZaLIu', 'RJ4cSi4Vev', 'cWrcLQyRAy', 'HuTY4ROAd1', 'kkoYH1T8q4', 'sRHYIEysk7', 't3SYNOMubL', 'X9dYT88BRQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, KtbRCnPGV3g9JaCKWq.cs	High entropy of concatenated method names: 'WZESUKjWev', 'DitSwB6IpI', 'WFeSQatW0H', 'uAKSWf6Zea', 'sfRSB7ScTJ', 'AgMSMytU1E', 'sgvSpEkOnk', 'dmLS3u8Itn', 'uMkS5HQ10S', 'kHSSDJfJdr'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, EHvuMMF99SvB1dqti4.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'L0hsTun5gY', 'rcxsn3SmFw', 'svHszXG2bG', 'VmdZe8Pl7D', 'tg2ZhOE2bs', 'TdPZsY6MOY', 'wA0ZZ5gIAu', 'AMgkK2cuPhHgboQsaTe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, AEtCUpnieagE1qWCO7.cs	High entropy of concatenated method names: 'lglqhUaDdZ', 'RFxqZSGZHT', 'W94qKuAN3S', 'BGDqkWwxWe', 'gayqfTOGhl', 'aK6qYFp1FJ', 'vfWqcltaVo', 'scJEIUJwx1', 'lO9ENm0S1U', 'dCxETuPQKo'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, TmEnIZLOqWm4t2waYK.cs	High entropy of concatenated method names: 'Bw0ZCXUlQi', 'wW5ZkoVfIH', 'vNYZf5oTHb', 'AMcZFkjXWv', 'JHGZYFaYLQ', 'IATZcurKrf', 'ONMZSBDOMg', 'pdcZLVuRMV', 'BAUZ2jBjCP', 'X7XZA8JGqq'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, FBV1Dw5ZgTllOldKB5.cs	High entropy of concatenated method names: 'yX7FWJAZlx', 'bqwFMgC6MT', 'RqyF35P1FO', 'fP0F5ljHtS', 'VMJFjcYXic', 'yahFOtUEPE', 'oDyFghYJrd', 'veqFEBof3v', 'pwFFql5wwB', 'kwDFmKoVMS'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, i869fXTc1kNoXy0mU2.cs	High entropy of concatenated method names: 'MbTErPrpsB', 'dRtEyQVRlk', 'RbdEG3XK5M', 'kJAElQB2hR', 'bn3ERIxCNJ', 'C2lEtYf50u', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, kYDhL9f2h3WLGPBHn3.cs	High entropy of concatenated method names: 'Dispose', 'zZDhTU4D82', 'mJLsy5ZQZO', 'UGHQQHI7MA', 'MxAhnBfFrc', 'p0dhzBK6Gg', 'ProcessDialogKey', 'kWcse869fX', 'i1kshNoXy0', 'sU2ssBEtCU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, vG3i1EsgSiNMtgnuiK.cs	High entropy of concatenated method names: 'kn9QZSw7U', 'agkWBBAQv', 'ghAMLnLe4', 'KeipKf2hC', 'jKt5arPE8', 'Ke0D8ZUwX', 'J7LmPKbhU92wTNLZEi', 'hEegOH0pIt5B2AY5sP', 'g8ME7fwDK', 'R1RmEiTCx'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, wABfFrNcO0dBK6GgLW.cs	High entropy of concatenated method names: 'F17EkTSYZP', 'yQ0EfDMBqO', 'TisEFm0uEb', 'FM5EYoffxR', 'dd2Ecku1m6', 'bX1ESBJpJr', 'pIUELwRWoG', 'g3KE29VvFn', 'oLgEAWqOdZ', 'A8rEuD1Zp8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, dco03Phe9sar7S4k4qp.cs	High entropy of concatenated method names: 'ocFqUcVbAD', 'hGjqwuMDJ1', 'ChPqQ5AtQw', 'tPdqWvxP92', 'GOfqBWIo7i', 'IaPqMOLnBe', 'DZJqpffwYH', 'GeCq3S1pNB', 'EqYq5owlsk', 'HZjqDsLeip'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, ywqai2H9nZfaNY0RN1.cs	High entropy of concatenated method names: 'sHxgNSeorL', 'RLMgnwEFEE', 'cYJEeq5pmg', 'oGuEhtWTPA', 'DKfgdH4XNk', 'PlKg7EqAuK', 'AtQgiAPEbM', 'yPwgRgo7On', 'jikgVcpr0U', 'BqJgblkGwS'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, edq3sdRYpWfB0PDWPH.cs	High entropy of concatenated method names: 'xHkj6TKamc', 'eUjj7q2VQ7', 'ubMjRHe2qi', 'QgtjVYmyeE', 'FdijyfoZXs', 'r5BjGjG4ME', 'UnGjlxO0Vg', 'NjJjtybJjn', 'Muuj1vHnlE', 'ctZj04sN4U'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3e85af0.9.raw.unpack, PiQ4WTi95yVj42VZoG.cs	High entropy of concatenated method names: 'R8KX3FIFJb', 'kitX53abjg', 'JyeXrHMT4Y', 'TbbXyJephb', 'KLdXlMvhCi', 'r4OXtoZyHX', 'lmyX0VHYSL', 'tuRXJLofQJ', 'jiAX6lxIbn', 'pRGXdFtK0w'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, zP3Sw1b647PecVj3MZ.cs	High entropy of concatenated method names: 'ToString', 'HiiOdAg4Ow', 'MJuOybHiFJ', 'wsqOG3NgFN', 'MbSOlZOlky', 'qVmOtWlovR', 'BkwO1nNMhj', 'GkBO0Tn2b1', 'pfZOJeQrYP', 'Ym6OPjqlg7'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, IgWa5u0pphRsdsPaLf.cs	High entropy of concatenated method names: 'pS6SkJXBkI', 'IiqSFcgOPJ', 'f7MScyZpsV', 'iGlcnAZatr', 'Vt5czV9BAZ', 'zanSemMi3v', 'PKMSh0gsUl', 'NDmSsj2SFE', 'S84SZadIgW', 'g8tSK4r2hQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, JLn7D8hhjyvuoE2t3Qx.cs	High entropy of concatenated method names: 'ToString', 'OUUmZduf4i', 'pAYmKec4t8', 'l7MmCmobx5', 'l0GmkA5hBi', 'd1AmfmnbIw', 'yt7mFDQUfs', 'EHYmYJ2idI', 'zZ7oC094VIPCBP1Ww4g', 'VeZ7gU9Xa3gCsZmxrDD'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, YlF6wUzmcuXIeW2Ao7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SLjqXAN53h', 'iSyqjS0R8I', 'wxIqOofBrZ', 'yIUqgZ0AkO', 'ehdqEqCHfg', 'mkGqq892KU', 'ipeqmSemOg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, HKq2vk3JKxqu31jYBK.cs	High entropy of concatenated method names: 'SKufRIPT3l', 'RUyfVuPj87', 'hW5fbyUlI9', 'i4Mf9ItYE2', 'bmSf4cQNfa', 'vfJfHL4IAQ', 'zB6fIMQQkI', 'MdTfNDdWw6', 'M6cfTrdhX4', 'uvbfniZ8Zg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, tWNQkBKsg3DHlvRJSw.cs	High entropy of concatenated method names: 'F3yhSKq2vk', 'LKxhLqu31j', 'yZghATllOl', 'OKBhu5qiOa', 'P9Ihj40HIR', 'O39hOyDEME', 'jKRk1mXGZUxKxeUWX5', 'PPwJL3smd5OZQStNha', 'NHrhhl8XOi', 'QaGhZs2uVA'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, VIRd39ryDEMEwAMs8A.cs	High entropy of concatenated method names: 'YaycC1VrbN', 'uOZcfGq2TA', 'kiMcYZaLIu', 'RJ4cSi4Vev', 'cWrcLQyRAy', 'HuTY4ROAd1', 'kkoYH1T8q4', 'sRHYIEysk7', 't3SYNOMubL', 'X9dYT88BRQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, KtbRCnPGV3g9JaCKWq.cs	High entropy of concatenated method names: 'WZESUKjWev', 'DitSwB6IpI', 'WFeSQatW0H', 'uAKSWf6Zea', 'sfRSB7ScTJ', 'AgMSMytU1E', 'sgvSpEkOnk', 'dmLS3u8Itn', 'uMkS5HQ10S', 'kHSSDJfJdr'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, EHvuMMF99SvB1dqti4.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'L0hsTun5gY', 'rcxsn3SmFw', 'svHszXG2bG', 'VmdZe8Pl7D', 'tg2ZhOE2bs', 'TdPZsY6MOY', 'wA0ZZ5gIAu', 'AMgkK2cuPhHgboQsaTe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, AEtCUpnieagE1qWCO7.cs	High entropy of concatenated method names: 'lglqhUaDdZ', 'RFxqZSGZHT', 'W94qKuAN3S', 'BGDqkWwxWe', 'gayqfTOGhl', 'aK6qYFp1FJ', 'vfWqcltaVo', 'scJEIUJwx1', 'lO9ENm0S1U', 'dCxETuPQKo'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, TmEnIZLOqWm4t2waYK.cs	High entropy of concatenated method names: 'Bw0ZCXUlQi', 'wW5ZkoVfIH', 'vNYZf5oTHb', 'AMcZFkjXWv', 'JHGZYFaYLQ', 'IATZcurKrf', 'ONMZSBDOMg', 'pdcZLVuRMV', 'BAUZ2jBjCP', 'X7XZA8JGqq'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, FBV1Dw5ZgTllOldKB5.cs	High entropy of concatenated method names: 'yX7FWJAZlx', 'bqwFMgC6MT', 'RqyF35P1FO', 'fP0F5ljHtS', 'VMJFjcYXic', 'yahFOtUEPE', 'oDyFghYJrd', 'veqFEBof3v', 'pwFFql5wwB', 'kwDFmKoVMS'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, i869fXTc1kNoXy0mU2.cs	High entropy of concatenated method names: 'MbTErPrpsB', 'dRtEyQVRlk', 'RbdEG3XK5M', 'kJAElQB2hR', 'bn3ERIxCNJ', 'C2lEtYf50u', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, kYDhL9f2h3WLGPBHn3.cs	High entropy of concatenated method names: 'Dispose', 'zZDhTU4D82', 'mJLsy5ZQZO', 'UGHQQHI7MA', 'MxAhnBfFrc', 'p0dhzBK6Gg', 'ProcessDialogKey', 'kWcse869fX', 'i1kshNoXy0', 'sU2ssBEtCU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, vG3i1EsgSiNMtgnuiK.cs	High entropy of concatenated method names: 'kn9QZSw7U', 'agkWBBAQv', 'ghAMLnLe4', 'KeipKf2hC', 'jKt5arPE8', 'Ke0D8ZUwX', 'J7LmPKbhU92wTNLZEi', 'hEegOH0pIt5B2AY5sP', 'g8ME7fwDK', 'R1RmEiTCx'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, wABfFrNcO0dBK6GgLW.cs	High entropy of concatenated method names: 'F17EkTSYZP', 'yQ0EfDMBqO', 'TisEFm0uEb', 'FM5EYoffxR', 'dd2Ecku1m6', 'bX1ESBJpJr', 'pIUELwRWoG', 'g3KE29VvFn', 'oLgEAWqOdZ', 'A8rEuD1Zp8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, dco03Phe9sar7S4k4qp.cs	High entropy of concatenated method names: 'ocFqUcVbAD', 'hGjqwuMDJ1', 'ChPqQ5AtQw', 'tPdqWvxP92', 'GOfqBWIo7i', 'IaPqMOLnBe', 'DZJqpffwYH', 'GeCq3S1pNB', 'EqYq5owlsk', 'HZjqDsLeip'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, ywqai2H9nZfaNY0RN1.cs	High entropy of concatenated method names: 'sHxgNSeorL', 'RLMgnwEFEE', 'cYJEeq5pmg', 'oGuEhtWTPA', 'DKfgdH4XNk', 'PlKg7EqAuK', 'AtQgiAPEbM', 'yPwgRgo7On', 'jikgVcpr0U', 'BqJgblkGwS'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, edq3sdRYpWfB0PDWPH.cs	High entropy of concatenated method names: 'xHkj6TKamc', 'eUjj7q2VQ7', 'ubMjRHe2qi', 'QgtjVYmyeE', 'FdijyfoZXs', 'r5BjGjG4ME', 'UnGjlxO0Vg', 'NjJjtybJjn', 'Muuj1vHnlE', 'ctZj04sN4U'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.74d0000.12.raw.unpack, PiQ4WTi95yVj42VZoG.cs	High entropy of concatenated method names: 'R8KX3FIFJb', 'kitX53abjg', 'JyeXrHMT4Y', 'TbbXyJephb', 'KLdXlMvhCi', 'r4OXtoZyHX', 'lmyX0VHYSL', 'tuRXJLofQJ', 'jiAX6lxIbn', 'pRGXdFtK0w'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ac6e2c.5.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ac6e2c.5.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ac6e2c.5.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ac6e2c.5.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.2ac6e2c.5.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 8910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 1660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Memory allocated: 50D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Window / User API: threadDelayed 1000			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Window / User API: threadDelayed 5260			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 5164	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7320	Thread sleep count: 1000 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7320	Thread sleep count: 5260 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98560s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe TID: 7312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98560	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97577	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2876160661.00000000014AC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2877478732.000000000311E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 7208, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 7208, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3dbc340.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.3d81920.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2877478732.000000000311E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 4856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe PID: 7208, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	31%	Virustotal		Browse
SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.elec-qatar.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://mail.elec-qatar.com	0%	Avira URL Cloud	safe
http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease	1%	Virustotal		Browse
http://mail.elec-qatar.com	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.elec-qatar.com	50.87.139.143	true	true	3%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.elec-qatar.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000002.00000002.2877478732.0000000003126000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sakkal.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1641297030.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, 00000000.00000002.1640952261.0000000005BF0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.139.143	mail.elec-qatar.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1414887
Start date and time:	2024-03-25 08:28:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe, PID 7208 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:28:51	API Interceptor	32x Sleep call for process: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
50.87.139.143	NEW ORDER 98540-0.exe	Get hash	malicious	AgentTesla	Browse
	Documents of shipment 3-2024.exe	Get hash	malicious	AgentTesla	Browse
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla	Browse
	Order 19A20060.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Proforma Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Variant.Lazy.463632.16595.14067.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	New order.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Quotation R2100131410.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Trojan.MSIL.Krypt.2433.31957.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.elec-qatar.com	NEW ORDER 98540-0.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	Documents of shipment 3-2024.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	Order 19A20060.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	Proforma Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SecuriteInfo.com.Variant.Lazy.463632.16595.14067.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	New order.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	Quotation R2100131410.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SecuriteInfo.com.Trojan.MSIL.Krypt.2433.31957.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	file.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	192.185.16.114
	SecuriteInfo.com.Win64.PWSX-gen.371.14469.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	https://duchessgarden.sn/	Get hash	malicious	Unknown	Browse	162.241.27.25
	DHL STATEMENT OF ACCOUNT - 1003657363.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	wn1gncGy2T.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	192.185.16.114
	https://se-sec-cru-sec-rity.linkpc.net/	Get hash	malicious	HTMLPhisher	Browse	96.125.163.17
	https://seeeee-rcurr--cu---ty.linkpc.net/	Get hash	malicious	HTMLPhisher	Browse	96.125.163.17
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	HTMLPhisher	Browse	192.185.189.216
	invite.hta	Get hash	malicious	Unknown	Browse	162.241.169.194
	https://www.followmyhealth.com/PatientAccess?Organization=//V7mYkE8.worleyenterprise.com%2Fam9uYXRoYW4uZ3JlZWxleUB5b2dpcHJvZHVjdHMuY29t??&Invite=9MnjZPjvSBkWo1AJg0Su4CMECM3Gy2EqMLythemnkfrUifOZKY6iVLesbc/wYCFYSg4z04xrxoVh+YBkzkGlbNg6ZfZpnz2Fxa8Lq5YeHuI=	Get hash	malicious	HTMLPhisher	Browse	69.49.228.234

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.921452103105054
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
File size:	727'040 bytes
MD5:	7806be4f71ce1b0fc27c40974ecb5041
SHA1:	bb38809901742d73eccbce01f4576aa6301d35fb
SHA256:	81ace4c307c53dcb5aa5e1d7a971d373a734c747408be3a9158bb00b5b11f8a2
SHA512:	f009fbb754c863d810099558671e10a665b36dfa655db06860d6de1b5469c125a102a776c99dbc03ac394ef95e5f5bd845a39fd86545ef473008096dd4365bb9
SSDEEP:	12288:J4CMwhctpl1p1TvwjnPWr8Av6cRnjW3YqHaB+QczbA:clXBvwjnPWPv6UqHaoQ
TLSH:	58F4120033AC2A73EABF9AF64829006143B2F57B3035D6EB1CC265DE59E6F045B65B17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..x............... ........@.. .......................`............@................................

File Icon


Icon Hash:	8b193a9ce163268d

Static PE Info

General

Entrypoint:	0x4a94a2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6601058C [Mon Mar 25 05:03:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 35h
xor eax, 43465138h
push eax
xor eax, 38453452h
xor dl, byte ptr [ecx+eax*2+5Ah]
push esi
dec eax
dec eax
inc ebx
inc esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa9450	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x8f24	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa70ac	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa74c0	0xa7800	d9c562796f7012e2116cb9991887920a	False	0.938603369869403	data	7.937152054368676	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x8f24	0x9000	bfce3d1fe259f97a34e6eb54596ba452	False	0.9531521267361112	data	7.928785045289302	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb4000	0xc	0x800	d1d0074212a6325f142002586a15e368	False	0.01611328125	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaa100	0x899d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9775185216724858
RT_GROUP_ICON	0xb2ab0	0x14	data	1.05
RT_VERSION	0xb2ad4	0x250	data	0.4814189189189189
RT_MANIFEST	0xb2d34	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 08:28:54.524694920 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:54.704447031 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:54.704544067 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:55.247286081 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:55.249224901 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:55.429382086 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:55.430327892 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:55.610626936 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:55.610951900 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:55.832616091 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:57.438328981 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:57.438661098 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:57.618351936 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:57.618724108 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:57.622991085 CET	587	49731	50.87.139.143	192.168.2.4
Mar 25, 2024 08:28:57.623058081 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:57.624447107 CET	49731	587	192.168.2.4	50.87.139.143
Mar 25, 2024 08:28:57.805243969 CET	587	49731	50.87.139.143	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 08:28:54.276191950 CET	56854	53	192.168.2.4	1.1.1.1
Mar 25, 2024 08:28:54.518208981 CET	53	56854	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2024 08:28:54.276191950 CET	192.168.2.4	1.1.1.1	0x4c13	Standard query (0)	mail.elec-qatar.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 25, 2024 08:28:54.518208981 CET	1.1.1.1	192.168.2.4	0x4c13	No error (0)	mail.elec-qatar.com		50.87.139.143	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 25, 2024 08:28:55.247286081 CET	587	49731	50.87.139.143	192.168.2.4	220-box2248.bluehost.com ESMTP Exim 4.96.2 #2 Mon, 25 Mar 2024 01:28:55 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Mar 25, 2024 08:28:55.249224901 CET	49731	587	192.168.2.4	50.87.139.143	EHLO 849224
Mar 25, 2024 08:28:55.429382086 CET	587	49731	50.87.139.143	192.168.2.4	250-box2248.bluehost.com Hello 849224 [102.165.48.43] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Mar 25, 2024 08:28:55.430327892 CET	49731	587	192.168.2.4	50.87.139.143	AUTH login bW9oYW1tZWQuYWJyYXJAZWxlYy1xYXRhci5jb20=
Mar 25, 2024 08:28:55.610626936 CET	587	49731	50.87.139.143	192.168.2.4	334 UGFzc3dvcmQ6
Mar 25, 2024 08:28:57.438328981 CET	587	49731	50.87.139.143	192.168.2.4	535 Incorrect authentication data
Mar 25, 2024 08:28:57.438661098 CET	49731	587	192.168.2.4	50.87.139.143	MAIL FROM:<mohammed.abrar@elec-qatar.com>
Mar 25, 2024 08:28:57.618724108 CET	587	49731	50.87.139.143	192.168.2.4	550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

Target ID:	0
Start time:	04:28:50
Start date:	25/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe"
Imagebase:	0x7ff7699e0000
File size:	727'040 bytes
MD5 hash:	7806BE4F71CE1B0FC27C40974ECB5041
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1638793445.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:28:52
Start date:	25/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe"
Imagebase:	0xd80000
File size:	727'040 bytes
MD5 hash:	7806BE4F71CE1B0FC27C40974ECB5041
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2877478732.000000000311E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2875221020.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2877478732.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	100
Total number of Limit Nodes:	6

Executed Functions

Function 04F96C10 Relevance: 31.7, Strings: 23, Instructions: 2915
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w, xrefs: 04F97AB8
w, xrefs: 04F98054
Q, xrefs: 04F9971D
w, xrefs: 04F9760E
w, xrefs: 04F99260
w, xrefs: 04F9779C
K, xrefs: 04F98ECB
w, xrefs: 04F98893
w, xrefs: 04F993EE
w, xrefs: 04F9957C
=, xrefs: 04F97480
E, xrefs: 04F9723B
w, xrefs: 04F98D3D
w, xrefs: 04F984FE
K, xrefs: 04F97C46
w, xrefs: 04F98BAF
K, xrefs: 04F97E4D
K, xrefs: 04F9868C
w, xrefs: 04F9792A
w, xrefs: 04F98A21
w, xrefs: 04F981E2, 04F997E2
w, xrefs: 04F98370
w, xrefs: 04F990D2

Memory Dump Source

Source File: 00000000.00000002.1640164622.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: =$E$K$K$K$K$Q$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w
API String ID: 0-1056130950
Opcode ID: 5998ba7ee47e84d521fd22211ae8eef6be27f040897598a608fe30ab6c024213
Instruction ID: a292ccaa7be21542d00f83c906ce1a61621c70bf39a7dedb62686575e5ccbbe6
Opcode Fuzzy Hash: 5998ba7ee47e84d521fd22211ae8eef6be27f040897598a608fe30ab6c024213
Instruction Fuzzy Hash: B2633930A10719CFEB14DF28C894B99B7B2FF89304F1186A9D909AB355DB70AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02900640 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1638026573.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e2251336898d723d95f42fe11696441011f91e595833325ad300f6fb8288ef
Instruction ID: 796eeabfacbc333db6d7de145e4412e08a5d8f1b4e128e7b52fd689cb62b6b89
Opcode Fuzzy Hash: 83e2251336898d723d95f42fe11696441011f91e595833325ad300f6fb8288ef
Instruction Fuzzy Hash: 8B91F271D45229CFDB68CF66CC847E9BBB6BF89300F1085AAD40DA6291EB715AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0288B1D0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0288B426

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4878ad03a8b62a9cdd596c374c3c3d12e5e06796720a5a6c02f4c5ca0b7c2a67
Instruction ID: 2717cd67f996d4c2e8bc16e4cb86f5a10afe3eaf4e293b4c3756bf8ca306e7d9
Opcode Fuzzy Hash: 4878ad03a8b62a9cdd596c374c3c3d12e5e06796720a5a6c02f4c5ca0b7c2a67
Instruction Fuzzy Hash: 01713778A00B058FD724EF6AD14175ABBF1FF88308F10892ED48AD7A50DB75E946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028858EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028859A9

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d92c44abc4f59618edf54e2ea864b1f0b7c2e32474611c757a752fa70dfefde2
Instruction ID: 582918c372f2c64158485ce3e7086c1b7b9d19087a6b0bc36d558e4a94e97120
Opcode Fuzzy Hash: d92c44abc4f59618edf54e2ea864b1f0b7c2e32474611c757a752fa70dfefde2
Instruction Fuzzy Hash: 2D41E2B4C00719CFDB24DFA9C884BCEBBB5BF48304F24806AD409AB255DB75694ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 04F91284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F94381

Memory Dump Source

Source File: 00000000.00000002.1640164622.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6cb4b290797e75a80ebcddf30c8659bfc57e973212788c8e1f33e703dce98ce0
Instruction ID: 37445f86df0c4a23d6b363914b1fdbf8563aafee24046b92cb36460d14ac975f
Opcode Fuzzy Hash: 6cb4b290797e75a80ebcddf30c8659bfc57e973212788c8e1f33e703dce98ce0
Instruction Fuzzy Hash: 434117B5A04209DFEB14CF99C448AAEBBF5FB98314F248459D519AB321D374A842CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028844E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028859A9

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ba34e425b70e12227a612a399f5ea671df43ad326fc952f5fe05d7f04f6becb2
Instruction ID: 96d730d12e3fc64fd67a87b3e999f85931f3105216533540297da197f21cdc9c
Opcode Fuzzy Hash: ba34e425b70e12227a612a399f5ea671df43ad326fc952f5fe05d7f04f6becb2
Instruction Fuzzy Hash: 1641E3B4C0071DCFDB24DFA9C884B9EBBB5BF48304F20806AD409AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02885A64 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1bd430bd37ecbad290d8b23324e4448f51bcd88ba6ea48fd078c0f7739358d
Instruction ID: a9be419b945d139070f6d14f8b7a57f9b7db207e474d45695ace0c2f8f7d23a3
Opcode Fuzzy Hash: de1bd430bd37ecbad290d8b23324e4448f51bcd88ba6ea48fd078c0f7739358d
Instruction Fuzzy Hash: F231E1B8804248CFDB01EFE8C8947DDBBF1AF06308F95419AD005EB265D778A94ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0288D238 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0288D66E,?,?,?,?,?), ref: 0288D72F

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 73730f8482255e5cc61b2ad522cd83bc8d3bad60f964a0c56016a120b4187ed2
Instruction ID: d2ed585c88bfe1a88f445339e63c65794d697e966048853a9c77b324d3d96845
Opcode Fuzzy Hash: 73730f8482255e5cc61b2ad522cd83bc8d3bad60f964a0c56016a120b4187ed2
Instruction Fuzzy Hash: 2D2116B5900248DFDB10DFA9D584ADEBBF4EB48314F14841AE958A3350D374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0288D6A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0288D66E,?,?,?,?,?), ref: 0288D72F

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 623c6fb2ed8b770da3f0635e7883e3b029a1e63b80b0a4e48fe1d841b9ff0ef9
Instruction ID: 5566b285ca7bbe7c1c4df63366cda543e754766b43217a8abbe714a7e1cc2db8
Opcode Fuzzy Hash: 623c6fb2ed8b770da3f0635e7883e3b029a1e63b80b0a4e48fe1d841b9ff0ef9
Instruction Fuzzy Hash: 422114B5900248AFDB10CFAAD584ADEBFF4EB48314F10841AE958A7350D374A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0288AEE8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0288B4A1,00000800,00000000,00000000), ref: 0288B6B2

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5cdb64d962b7794ac424e93e4244e6fddf47f563652c8c09b2443a40e6176160
Instruction ID: 4f5710371b123d148690b8566e0b4739044d1afa9e2431c1525a80beaea259b6
Opcode Fuzzy Hash: 5cdb64d962b7794ac424e93e4244e6fddf47f563652c8c09b2443a40e6176160
Instruction Fuzzy Hash: 3411F6BA9003499FDB10DF9AC444ADEFBF4EB88318F10842AE559A7211C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0288B641 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0288B4A1,00000800,00000000,00000000), ref: 0288B6B2

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 77824aa12ee69f0273a0de127fb757ef5169770a87b0cd679b832f39aef9d1ad
Instruction ID: 8d39582f71bdb71b7e139dec9e5574755614a09505ed67246f9492c6f1083c7d
Opcode Fuzzy Hash: 77824aa12ee69f0273a0de127fb757ef5169770a87b0cd679b832f39aef9d1ad
Instruction Fuzzy Hash: 551112BA9002498FDB20DFAAC444AEEFBF5AB88314F10842AD419A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0288B3C0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0288B426

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5173735fbc6757ce19856004bfa528f2642fdd5542dc9b82ff84f3e2fc1bd17d
Instruction ID: 209a2b1a81318daaa04619ed06be4d2fc54f17d76d07650ce20cb39a8a7486b0
Opcode Fuzzy Hash: 5173735fbc6757ce19856004bfa528f2642fdd5542dc9b82ff84f3e2fc1bd17d
Instruction Fuzzy Hash: C9110FB9C003498FCB10DF9AC444ADEFBF4AB88228F10C42AD459A7211C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02901768 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 029017C5

Memory Dump Source

Source File: 00000000.00000002.1638026573.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c9804425400ff98a46c2f4dc4391a881959be7eadc957c6a03fe3fc1413e84d4
Instruction ID: af68ab2036d0eb8b13b84798ae9f8f3fe03dbb93de82fcb4741c80e014a51b7d
Opcode Fuzzy Hash: c9804425400ff98a46c2f4dc4391a881959be7eadc957c6a03fe3fc1413e84d4
Instruction Fuzzy Hash: DA1100B5800348DFDB10CF9AC884BDEBBF8EB48324F10885AE558A7650C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02901763 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 029017C5

Memory Dump Source

Source File: 00000000.00000002.1638026573.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a7dd4d9777244260d6e518dfa7c849f8804f206c052dfacffd94329484e642c5
Instruction ID: 28133176c83363556acf4a5779182346cc3953d1c00fb0bb9ae319e42427b895
Opcode Fuzzy Hash: a7dd4d9777244260d6e518dfa7c849f8804f206c052dfacffd94329484e642c5
Instruction Fuzzy Hash: ED1100B5800348DFDB10CF99C989BEEFBF8EB08324F10885AE558A7650C374A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636940283.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa1a955af0de2ab2e8cc09b4b0a1a0ee5c34fe2df6ee5ff85d8579cbd5eb651
Instruction ID: 36892a5355b65b0f63d60e0a00670a640136f6579062904335578c6bc0289b39
Opcode Fuzzy Hash: cfa1a955af0de2ab2e8cc09b4b0a1a0ee5c34fe2df6ee5ff85d8579cbd5eb651
Instruction Fuzzy Hash: FC212871500208DFDB05DF14D9C4B26BF67FB94314F25C169DA094B256C336E856C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636940283.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b0b495dd908ea41db1be2ac09534462432e002be2252d7899b4d391df1c7fa
Instruction ID: c1aabfd4558cd770c1a473feb486e14298eab3bfcac9f7478c62c0a37fc4579a
Opcode Fuzzy Hash: 73b0b495dd908ea41db1be2ac09534462432e002be2252d7899b4d391df1c7fa
Instruction Fuzzy Hash: 3F21FFB1504248EFCB05DF14D980B2ABF67FB98318F24C569EA490B356C336D856DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636997824.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311bc8739ec9aebb0c857ce8e12247e9233cfb5c99caaedd17c0b13452cbc39c
Instruction ID: ca911c107ccca57c1003ef369f91b9138e7d6484bda20c7b33d33cf547f88dbd
Opcode Fuzzy Hash: 311bc8739ec9aebb0c857ce8e12247e9233cfb5c99caaedd17c0b13452cbc39c
Instruction Fuzzy Hash: 9F210471508304EFDB05DF94D9C0B26BBA5FB84318F20C66DE8095B2A6C336D896CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636997824.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2079f5cb4115b07a3c2f98207abf117f7dd6bac0b828ce2e391c08158e038fa5
Instruction ID: 4264615849dba07012dc3fa4310b32f6292a914cf635cf810bab46e223366690
Opcode Fuzzy Hash: 2079f5cb4115b07a3c2f98207abf117f7dd6bac0b828ce2e391c08158e038fa5
Instruction Fuzzy Hash: C821F271608200DFDB14DF54D984B26BBA6EB84318F20C569D84E5B296C33AD887CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636997824.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ad4745f44ecc2daaf25d5fa06b8e718b2b02ee0e169172c01d469af2599ce1
Instruction ID: a09051e606c65a65067a9dda346b4b4d7f5621bfba1858ff9f82c2c28fe02721
Opcode Fuzzy Hash: 95ad4745f44ecc2daaf25d5fa06b8e718b2b02ee0e169172c01d469af2599ce1
Instruction Fuzzy Hash: 8821837550D3808FC702CF24D994715BF71EB46314F28C5DAD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636940283.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 6711799c8d4c8bd4f148a6ff89b05dc404e7d5efe7d1ce7e724faaa52326ae42
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: AE110372404244CFCB02CF00D5C4B26BF72FB94324F28C2A9D9090B656C33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636940283.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d8a48206a908892c1781dd8cdc30df82586503a33997b087fcce6855bfef39b5
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 3311D376504284CFCB16CF14D5C4B26BF72FB94318F28C6A9D9490B756C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636997824.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d1dfb7d06571bcab76e5352e397086b29a1ba23414d8f9e289e7682a73e1d4af
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BB11BB75508280DFCB02CF94C9C4B15BBA1FB84318F24C6AAD8494B6A6C33AD85ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636940283.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafa884b98f9a0c4e0212567340addc73d70ac02330127c23cc137171985e4e4
Instruction ID: 61b4bc9fd26e9eaef4fe864b8f359ba3c24fef9a2caeb7ca741ab2ae57e06aa2
Opcode Fuzzy Hash: cafa884b98f9a0c4e0212567340addc73d70ac02330127c23cc137171985e4e4
Instruction Fuzzy Hash: 7B01A7710083489AE7116E25CD84B77BF9ADF41324F18C52AEE4A4E296D679D841C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636940283.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dfd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e12102272e7bed5bd19750832f36c6518ac22f418c5411635505ae4c0ee0bc9
Instruction ID: bf61d04d8175b80b0cf4cd3027de5b553b2e0691a876d43d16f92d81ef4b307b
Opcode Fuzzy Hash: 7e12102272e7bed5bd19750832f36c6518ac22f418c5411635505ae4c0ee0bc9
Instruction Fuzzy Hash: D3F062714043449AE7109E16CD88B66FFA9EB91734F18C45AED494E296C2799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02903250 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1638026573.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3811728cfd1575dea736f67bc180b51b530f7a584a66086ef08506d77b7438
Instruction ID: 300a791fcbc86905ee262b8439eadb41d41cc4d28d212fd82ca256ed2a87786c
Opcode Fuzzy Hash: 1f3811728cfd1575dea736f67bc180b51b530f7a584a66086ef08506d77b7438
Instruction Fuzzy Hash: C8D1A8357016089FDB19EB79C490B6EB7EBAF89704F1484AED14ACB2E0CB35E801CB55

Uniqueness

Uniqueness Score: -1.00%

Function 04F90040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1640164622.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6976e236532af24914853c8ed7464c72a274faa2efca0af4c3ded3e2f549a6bf
Instruction ID: add88c5a7eed9ba901ecc88121c6a3585e02b5b02d21cb3935d464bf6a4fb171
Opcode Fuzzy Hash: 6976e236532af24914853c8ed7464c72a274faa2efca0af4c3ded3e2f549a6bf
Instruction Fuzzy Hash: 6D12B6B0401746EAD310CFA7E95C18A3BB1FB8531EF504649E2616F2E9DBBC994ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0288DFCC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1637888828.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cd501cef35207214410204358395a1b0efb4ca720ea5d864000622cbf42eef
Instruction ID: 7d1cadb9947e94994bf22ec6ac090d71db8d49e5fa36f09df4f8da7bd426c64c
Opcode Fuzzy Hash: b1cd501cef35207214410204358395a1b0efb4ca720ea5d864000622cbf42eef
Instruction Fuzzy Hash: 02A16B3AE002098FCF05EFB5C8805AEB7B2FF85305B55456AE905EB265DB35E946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04F9001C Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1640164622.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62f6aa2c7181b6e4970076379700a88380b34e955566a8a40d78b31e657f25a
Instruction ID: baa73419b8634f622c22ea5132c50053ffe649e7cc69960b666d98c46a7be644
Opcode Fuzzy Hash: e62f6aa2c7181b6e4970076379700a88380b34e955566a8a40d78b31e657f25a
Instruction Fuzzy Hash: 51C128B0800746AAD710CFA7E85818A7BB1FB8531EF554349E2616F2E9DBBC584ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 02900630 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1638026573.0000000002900000.00000040.00000800.00020000.00000000.sdmp, Offset: 02900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2900000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eaa86c0d2942c552942928f86918f83c1a2358f43565923d774651166a5b8f7
Instruction ID: 5cc0368c8ed8e9f5db3da737fa8d9a6c0a1b98f0b8c634a58a12966a10d60372
Opcode Fuzzy Hash: 8eaa86c0d2942c552942928f86918f83c1a2358f43565923d774651166a5b8f7
Instruction Fuzzy Hash: BF31B6B1E056288EEB58CF6B98443DDBAF7AFC9300F14D1AAC40CAA255DB7405858F01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exePID: 7208, Parent PID: 4856COMMON

Executed Functions

Function 01669B30 Relevance: 2.8, Instructions: 2817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d100d9ae5ac137cc6b96db6b877b3137c15c9af106aca7d2ec3c5535dfe3d4d8
Instruction ID: 716f6c88851a7dd1d6c9b338f5e66a97abbd981b6939d311c1d4643e5c927871
Opcode Fuzzy Hash: d100d9ae5ac137cc6b96db6b877b3137c15c9af106aca7d2ec3c5535dfe3d4d8
Instruction Fuzzy Hash: B753F831D10B1A8ACB51EF68C8805A9F7B5FF99300F15D79AE45877221FB70AAD4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0166CDA8 Relevance: 2.3, Instructions: 2340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a8518e923e70ad42cea957c0c7c47f0265440d329dcda3528e2cc76285e179
Instruction ID: 22a0be3c86f972cb7e2adeef1807dfaf6466b46fc059786132ad7582b96fe383
Opcode Fuzzy Hash: 36a8518e923e70ad42cea957c0c7c47f0265440d329dcda3528e2cc76285e179
Instruction Fuzzy Hash: D833FC31D1061A8EDB11EFA8C89069DF7B5FF99300F15C79AD458A7221EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01664A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca237832f269da7288e098d996bf96a7fd38df9966e7467a46a62a17ffab8a9c
Instruction ID: 51dc7fc22a2b35ab498e6eb00b577111a614572c5e17e44bc41ff99f1184d15b
Opcode Fuzzy Hash: ca237832f269da7288e098d996bf96a7fd38df9966e7467a46a62a17ffab8a9c
Instruction Fuzzy Hash: 95B14B71E002098FDB14CFA9DC917ADBBF6AF88354F188129D819E7394EF749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01663E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171284453e6a4a812bdb603e7729455f7783296884c31272abeda0f145447b33
Instruction ID: dcfe9cf0b8e1a102c3682a71e6810aa08f789804bd75cf47e7f77888ddc744d4
Opcode Fuzzy Hash: 171284453e6a4a812bdb603e7729455f7783296884c31272abeda0f145447b33
Instruction Fuzzy Hash: 99915B70E00219DFDB14CFA9DD857AEBBF6BF88314F148129E419A7354EB749886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01666EDA Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01666F0E
LR^q, xrefs: 01666FBD

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 679db0495b7be20c19a6254bfb885a56da3986da41fb6eeb29e1f41e6bf3e2f0
Instruction ID: 84aa936299ce2a7d00f6ea4cf307e33e6fb28e6474760036649b1cf6a9b2d5cd
Opcode Fuzzy Hash: 679db0495b7be20c19a6254bfb885a56da3986da41fb6eeb29e1f41e6bf3e2f0
Instruction Fuzzy Hash: EA51FF30E102459FDB16DF79D8506AEBBB6FF8A304F20846AE405EB391DB719846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0166F3FD Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0166F54B

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 28970e3c914ba99f9a1f17039145f141c4d0873b7a6e5a47f4755412b0f243ac
Instruction ID: 821c9d0b7d9827eaf8255e6f72a85768fb3f299a43b22a331f0a9fcea718d48e
Opcode Fuzzy Hash: 28970e3c914ba99f9a1f17039145f141c4d0873b7a6e5a47f4755412b0f243ac
Instruction Fuzzy Hash: 3841D2317002018FDB269F38E9646AE7BE6EF89600F1444B9D006DB396EF39DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01666F78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01666FBD

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: bd33cc08b521e65787509f1d321bbc577a113d9369f19e71d67c760a977315f1
Instruction ID: 55dba867274a3c4bc23973cd38838f4eea57614725ac72ead481a94e1c17c37d
Opcode Fuzzy Hash: bd33cc08b521e65787509f1d321bbc577a113d9369f19e71d67c760a977315f1
Instruction Fuzzy Hash: 0D31AD74E102099FDF15CFA9D8407AEB7B6FF85304F60852AE806EB340EB71A846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01666B47 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01666BD7

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 2e3e7456557d47a9a86ff1b0b1049f9de68fb65b6748f077736108c8b5131073
Instruction ID: df99db81b26bcb6aa32b39dca7ebf9dc971c127c3321f3c7544de78863fc3444
Opcode Fuzzy Hash: 2e3e7456557d47a9a86ff1b0b1049f9de68fb65b6748f077736108c8b5131073
Instruction Fuzzy Hash: 62317B716041504FC302BF3DE4502AE7FA6EF96240F0445BED085CB39ADA39CC86C796

Uniqueness

Uniqueness Score: -1.00%

Function 01666B8F Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01666BD7

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 6ac278a67171b6442ed43b161d99c9c0243c1561336855d09e90044d36b3a60e
Instruction ID: 02ac4fca22aca7f7643a6178ea710b5592e35e7f54f0992547656b0cfd3c1cde
Opcode Fuzzy Hash: 6ac278a67171b6442ed43b161d99c9c0243c1561336855d09e90044d36b3a60e
Instruction Fuzzy Hash: 931129326051815FD30AAB79D4652AE7FB6EF8A640B1444AFC045CB392DE31C843C792

Uniqueness

Uniqueness Score: -1.00%

Function 0166790A Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d17a21f466c5c9a29dea13edf44bfb121837835d8dae6eec6c79c7d3b518cb2
Instruction ID: 29d9a987e7a8268eeab09a7bda8b2de3040101afdceddf92c653a9442e39a937
Opcode Fuzzy Hash: 2d17a21f466c5c9a29dea13edf44bfb121837835d8dae6eec6c79c7d3b518cb2
Instruction Fuzzy Hash: 281281307122068FCB16AB3CE85462DB7A6FB95354FA04A3DD406CB365CF75DC8A8B81

Uniqueness

Uniqueness Score: -1.00%

Function 016696E0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ad445eca28f57166e2c6c5751397b832e48965d9f8ef8861af8a3b638b4863
Instruction ID: 9bf7f6637174c1621df9dbbf652f75d75112f52a7f86ca38806cc0cca9a8b61b
Opcode Fuzzy Hash: c3ad445eca28f57166e2c6c5751397b832e48965d9f8ef8861af8a3b638b4863
Instruction Fuzzy Hash: F1D19171A002058FDF15CF69D8807AEBBBAFF88314F14856AE909DB396DB34D845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01669364 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073a4dc4872009da806e792f4e2b2ac210e9265ca2849e98835c083f9183dfd0
Instruction ID: 53892cde02a1ec3d2b2e57d3df30084c591a2347c13a636ef9106d90eb67186b
Opcode Fuzzy Hash: 073a4dc4872009da806e792f4e2b2ac210e9265ca2849e98835c083f9183dfd0
Instruction Fuzzy Hash: 02C1B134A002188FDB15DF69D994AADBBB6FF88314F108469E806E73A5DF34EC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01664A8D Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe749b2fb0a72b4a57a08517b106da14947686f73a80d1038511b04b59f664b
Instruction ID: 4cb41ec9727472f858d7b45b16d4b2c1f0e2d052339dc23fb3ff06c3da22e171
Opcode Fuzzy Hash: 5fe749b2fb0a72b4a57a08517b106da14947686f73a80d1038511b04b59f664b
Instruction Fuzzy Hash: D2B13971E002098FDB10CFA9DC957EDBFF5AF88354F188129D819AB354EB759886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01663E74 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6fb6f07e398b19e800aba70ee4fb3f83cac585bbe22fe1e492ef51823181a8
Instruction ID: 2f627cc53799083e79fe70b2abeb6bb930fe61f039bf1a456aae12df4f09aafb
Opcode Fuzzy Hash: 4a6fb6f07e398b19e800aba70ee4fb3f83cac585bbe22fe1e492ef51823181a8
Instruction Fuzzy Hash: B6916AB0E00209CFDB10CFA8D9857AEBBF6BF58314F148129E459A7354EB749886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01664804 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd17afb8f0dc7c00bed50dbe045d777128ce131b7a2021e512ca10a68c78765
Instruction ID: dfdbee03bf850cb7514ecfbe54e0f76cfc02d12e4ea90aeef5f03a04d99e6ccc
Opcode Fuzzy Hash: 2fd17afb8f0dc7c00bed50dbe045d777128ce131b7a2021e512ca10a68c78765
Instruction Fuzzy Hash: E8718CB0E00249DFDB10CFA9D8817DEBBF6BF48314F148129E815A7354EB349846CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01664810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8037ce5766ae28831d0f105838d8f36c6e75abf1cbddd0bce07253eb972fd51a
Instruction ID: c09aa1ae4a018663372cc5386ce665060836e03ac1e9f06a52c81d36f772ca8b
Opcode Fuzzy Hash: 8037ce5766ae28831d0f105838d8f36c6e75abf1cbddd0bce07253eb972fd51a
Instruction Fuzzy Hash: 45717BB0E00249DFDB14DFA9D8807DEBBF6BF88314F148229E815A7354EB749846CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01661878 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb0ad81adbe858ff9ac00d35b4b363fa1692edc97bc3167854ce160a7b2590e
Instruction ID: 18d6a5624d3a55398041d40fcfafbe81b4bf04321d61f166670a48e11153e2ab
Opcode Fuzzy Hash: 2eb0ad81adbe858ff9ac00d35b4b363fa1692edc97bc3167854ce160a7b2590e
Instruction Fuzzy Hash: FD51E171B002458FDB21DF78C8556AE7BFAAF8A244F1404ACD546EB351DB398C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01666CE2 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7007f6d2cb93e7d402591091e27ebaa7387a02246f3335d8cb16718492365f2d
Instruction ID: c976370fa6a2128ebb6078a1bbcb41565574742d7bd2a9fb2b7eed715f4f1ed5
Opcode Fuzzy Hash: 7007f6d2cb93e7d402591091e27ebaa7387a02246f3335d8cb16718492365f2d
Instruction Fuzzy Hash: 39510471D002188FDB18CFA9D885BDDBBB5BF48314F14812AE819BB351DB749845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01666CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607eeacbf27bedac44d54f8e387a3154dbea4c70b7eeb72a91dc301ca39469f3
Instruction ID: e57a3b313eee225374d29fa1c547ab54a05d3c878c4c55b58d954e7a299daaa2
Opcode Fuzzy Hash: 607eeacbf27bedac44d54f8e387a3154dbea4c70b7eeb72a91dc301ca39469f3
Instruction Fuzzy Hash: 1F510271D002188FDB18CFA9D884B9DBBB5BF48714F14812AE81ABB351DB74A845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0166112A Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafc125cbebdb235ec96951469827a2b8c89bf27fdeb0ca289963c3b4589d933
Instruction ID: 893bb208ea0e3f27bb745e1a347a47e35734f3ffdfcf974cc6d9d09dd786113d
Opcode Fuzzy Hash: bafc125cbebdb235ec96951469827a2b8c89bf27fdeb0ca289963c3b4589d933
Instruction Fuzzy Hash: 8951A6312032418FC715EF68FD90A597BB2EB9230474496BDD8046B23ADB3C6D4ECB92

Uniqueness

Uniqueness Score: -1.00%

Function 01661138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613acec14d99e222e6211a018175fb4c53bfcf489b43bc2b14b2144daf559a10
Instruction ID: 8b72845300c6a167539840dcd0441c1879f8ec361781deb338e0e9db2cbaac51
Opcode Fuzzy Hash: 613acec14d99e222e6211a018175fb4c53bfcf489b43bc2b14b2144daf559a10
Instruction Fuzzy Hash: 435181312132418FC715EF68FD90A597BB2E79230474496BAD8046B33ADB7C6D4ECB92

Uniqueness

Uniqueness Score: -1.00%

Function 0166F2C0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a38b7d8343e0a3935cf50a7b30f2e88b21f6c0a14954484a0a4f00adfd48b6d
Instruction ID: 1bde4033df17860b47418a2237e17477a350b830b1331ff0e880c0f51e43f55b
Opcode Fuzzy Hash: 4a38b7d8343e0a3935cf50a7b30f2e88b21f6c0a14954484a0a4f00adfd48b6d
Instruction Fuzzy Hash: 51317035E102069BDB15CF69D8A469EBBB6FF89300F108569E806E7351DB70AC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 016626DD Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3f8e2361977545facdd19d170a132888056897911e33f56edb0ee7d2fff9e9
Instruction ID: 21c5454e39f6224ad866c2b87ef8945b24abb314334f3bc37c5fc141dc7f606a
Opcode Fuzzy Hash: dc3f8e2361977545facdd19d170a132888056897911e33f56edb0ee7d2fff9e9
Instruction Fuzzy Hash: 4241FFB0D00249DFDB10CFA9C895ADEBFB5FF48310F10802AE419AB254DB75A94ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0166F2D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33779b89aeeda534e461e25f1d3736e7f60c00893854f0a0edf2f4bfbc43834
Instruction ID: c2cd022c81d3f1b52adaf869e4424f2931c5aaf6e68259faece0dce57854ac46
Opcode Fuzzy Hash: d33779b89aeeda534e461e25f1d3736e7f60c00893854f0a0edf2f4bfbc43834
Instruction Fuzzy Hash: D1315C34E102059BDB15DFA9E8A4A9EB7B6FF89300F108529E806F7351DB70AC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 016626E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adaaab08cccd620d4ba9a457e2286ee0dbd24261efd208320d4462c02ae3f0d0
Instruction ID: b319649dffcb59330b9be236af3be348d8abd39a62701bbf8519da158a45e136
Opcode Fuzzy Hash: adaaab08cccd620d4ba9a457e2286ee0dbd24261efd208320d4462c02ae3f0d0
Instruction Fuzzy Hash: CD41EEB0D00249DFDB14DFA9C894ADEBFB5FF48310F10802AE819AB254DB75A949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01669251 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc94713feb1dd0b790ae3ed32ddf6fec69d81f42ad7de7496366aa44f2b9ec75
Instruction ID: 113f93df2a83ad82989ef291cd5a1da26d42927e311ca614e7e0317b29d830ff
Opcode Fuzzy Hash: fc94713feb1dd0b790ae3ed32ddf6fec69d81f42ad7de7496366aa44f2b9ec75
Instruction Fuzzy Hash: DC316F31E102059FDF05CFA9D85069EFBBAEF85304F54C629E805EB351DB719846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016616A0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefbec4fda7a4abf5fa9d43a22bafbd47d142cff95c163ed64391b00bb5828d4
Instruction ID: f7a4f8499a0d699847e9fef3d4a0159044f7b75f3472409aed222136e81ed8e3
Opcode Fuzzy Hash: fefbec4fda7a4abf5fa9d43a22bafbd47d142cff95c163ed64391b00bb5828d4
Instruction Fuzzy Hash: 733182345052444FDB22AB38EC547697B69EB82244F144AB6D846CB367EB3CDC498B92

Uniqueness

Uniqueness Score: -1.00%

Function 01661380 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a16a1f9d63cfb923d44e9eefbcf1f126bd58084491b81c07158d427a0d921f
Instruction ID: 4e7f1449f4b9e048123edeb994f0c2e5c579c09d7bc8c561a36699ee22dab955
Opcode Fuzzy Hash: 39a16a1f9d63cfb923d44e9eefbcf1f126bd58084491b81c07158d427a0d921f
Instruction Fuzzy Hash: 80219270A012444FEB326B38DC9436DFB69EB83390F10087AD947DB392DB388C868752

Uniqueness

Uniqueness Score: -1.00%

Function 01669260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf1946036af5266fa37cd406f7ed9b0dcf337bee4ea800dbac20baca305b5b9
Instruction ID: 9a7082e20a9df879219a072088d8e470c59394b07432199568357f12022af851
Opcode Fuzzy Hash: 2bf1946036af5266fa37cd406f7ed9b0dcf337bee4ea800dbac20baca305b5b9
Instruction Fuzzy Hash: F7214C31E1020A9FDB05CFA9D89069EF7BAFF89304F54C629E805EB341DB709846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01664F88 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8115d47b93879bf0d40cc6d3af095c809bb7240c5277c39bdcb7da2dc6626fdb
Instruction ID: ba93891fea638ed4508107aeb5aafe7684b4916d50548858a96f2baafdf36020
Opcode Fuzzy Hash: 8115d47b93879bf0d40cc6d3af095c809bb7240c5277c39bdcb7da2dc6626fdb
Instruction Fuzzy Hash: 42212834700205CFDB24DF78C95AAADBBF5EF89244B2044A8E406EB365DB76DD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01669150 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85a3378da17b24794b6e1104599638a1338f801207e717793b6d148ab62fb0e
Instruction ID: 0ea92de974d60b0741fcca859630cc79304f57f734b585a091775cf32a1ef021
Opcode Fuzzy Hash: d85a3378da17b24794b6e1104599638a1338f801207e717793b6d148ab62fb0e
Instruction Fuzzy Hash: 15217F34E002069FDB19CFA4D8546EEF7B6AF89304F20852AEC15FB341DB719846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0161D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2876813993.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_161d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ea6f3ad07cdde1f89c746e937c493faab5a597a487e50358cb54afa05d21cc
Instruction ID: 64e8fcb375032683f1923c8fa6676b92ccf2350722fa2e4decec2675475ebdce
Opcode Fuzzy Hash: d9ea6f3ad07cdde1f89c746e937c493faab5a597a487e50358cb54afa05d21cc
Instruction Fuzzy Hash: 07212275604200DFCB15DF58D988B26BFA5EB84315F28C56DD80A4B39AC33AD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 01669160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5bdcf9beae475cdbbaba788c91a6b2da9aa9087212d0a4a0445487d7ad5734
Instruction ID: 9d2a97b79a7e27354ef16827c6d06afbb636de5d400b943fa2222efd0f780e86
Opcode Fuzzy Hash: ab5bdcf9beae475cdbbaba788c91a6b2da9aa9087212d0a4a0445487d7ad5734
Instruction Fuzzy Hash: 88217F34E0020ADFDB19CFA4D85469EF7BAAF89304F60852AEC15FB340DB71A846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01661888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12c3b2f2d9a8d3dac163ce47168f6215c49a5d20b2b906243f25c7f3e26c1a8
Instruction ID: 7cc963a84dfe39b7d2fad6c0c378d5c54ac59ec33ee02bfffc841f9e6feaa248
Opcode Fuzzy Hash: f12c3b2f2d9a8d3dac163ce47168f6215c49a5d20b2b906243f25c7f3e26c1a8
Instruction Fuzzy Hash: A8212A30B00205CFEB14EF68C9156AE77BAAB8A245F20056DD506EB364DB369D41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 016616B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ff540a3c18f8a6078dcd12cb2799b03cccbd3d3936c9c54ddfcf574657a134
Instruction ID: 807f0ad5d020f2a766c31044ddd0cb8c985f05e1ffbb9407587b8da53d3b048e
Opcode Fuzzy Hash: 90ff540a3c18f8a6078dcd12cb2799b03cccbd3d3936c9c54ddfcf574657a134
Instruction Fuzzy Hash: 8C2163346011059FDF21EF28EC84729BB69E785354F104A35D80AD735AEB3CDC898B92

Uniqueness

Uniqueness Score: -1.00%

Function 01664F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7308a6cff2f4b4b900fe1519ff8c06409111f4248eb9cde9431f96851f276ef4
Instruction ID: 55ecba102157474c041403fcfe42e4c4e9938d2203e4ed79779cb476b74848b8
Opcode Fuzzy Hash: 7308a6cff2f4b4b900fe1519ff8c06409111f4248eb9cde9431f96851f276ef4
Instruction Fuzzy Hash: 4C211634700205CFDB24EF78C959AADB7F5EF89244B2004A8E406EB3A4DB3ADD00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016617C0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099d977061042c009e0cd520e6b8765be1c78f3c7db078ef7a96d53de70dea44
Instruction ID: fe1676f2e772e1d3696c7320a03bc6a417ed046b61b13270867cdd567588f68c
Opcode Fuzzy Hash: 099d977061042c009e0cd520e6b8765be1c78f3c7db078ef7a96d53de70dea44
Instruction Fuzzy Hash: DD110476F002448FCF219F789C086BEBFE9EB897A0F140568D94AD3341E7398C068B81

Uniqueness

Uniqueness Score: -1.00%

Function 0161D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2876813993.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_161d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f676f77ebc685f171951ce491b873b7b13d19fe58993af1971ed4760bb0c0f7
Instruction ID: a1e83cdfdc015d1e49e0e85a6a652d96e0c42d7f9b30a2e16774341d10845c5b
Opcode Fuzzy Hash: 3f676f77ebc685f171951ce491b873b7b13d19fe58993af1971ed4760bb0c0f7
Instruction Fuzzy Hash: E921AE755093808FDB03CF64D994B15BF71EB46214F28C5EAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0166148A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a45947deb2506f199eb9053a3ab6535f8df73358a822cc6cd60f03fc42ed2bc
Instruction ID: f8299a7e7685a2e3daa2b32a8f33089d4f10ea2234419031e846eb7e09cd125a
Opcode Fuzzy Hash: 1a45947deb2506f199eb9053a3ab6535f8df73358a822cc6cd60f03fc42ed2bc
Instruction Fuzzy Hash: 40119171E012119FCF26AFBC8C512EDBBBAEF89210B1404BED805E7302E735C8428B95

Uniqueness

Uniqueness Score: -1.00%

Function 01660848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ac30b2808176825b266e27ad28a080c79175c9a779bea7e095399593e465b8
Instruction ID: 42e1b22ab4125cac38480784e049e477e316eba048793bff7536ef84b7a0ab46
Opcode Fuzzy Hash: 16ac30b2808176825b266e27ad28a080c79175c9a779bea7e095399593e465b8
Instruction Fuzzy Hash: 55119D30B502049FDF15EA7DD80432A72AEEB81250F12893DE402DB356DB68CC858BC1

Uniqueness

Uniqueness Score: -1.00%

Function 01660838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e43f7ed0a8228e7540af2ca33c10929267a7ae7a4119660976f4e5e6d745511
Instruction ID: a81dd9a726c7b49f2e2bffce97ac6b2109a9ed9b7d0653d704f6fe21977c046b
Opcode Fuzzy Hash: 4e43f7ed0a8228e7540af2ca33c10929267a7ae7a4119660976f4e5e6d745511
Instruction Fuzzy Hash: E7118F30B512059FDF269A79DD5037977AEEB42250F11897EE402DB382DB68CC868BC2

Uniqueness

Uniqueness Score: -1.00%

Function 01661498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56eca241391d2a20a3bc97ccf3268a1750a3cfd15bd940bce8ea16746ef750a2
Instruction ID: f998bb69d6fb55d2cd3f518e7f2e37cb43f01e95230b810f8ce5a8f84d569c95
Opcode Fuzzy Hash: 56eca241391d2a20a3bc97ccf3268a1750a3cfd15bd940bce8ea16746ef750a2
Instruction Fuzzy Hash: 2D015271A012259FCF25EFBC8C501AEBBFAEF89211B14047AE805E7301E735D9418BE5

Uniqueness

Uniqueness Score: -1.00%

Function 016640FF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1877d5d7447061a2453310cfec3cda126f75f3c51b94dbcdd8f66509bd0112f
Instruction ID: 284187699e6dcb7aa0c5d1c6f29306547dcc325a000f222ef7904a73a37d2f83
Opcode Fuzzy Hash: e1877d5d7447061a2453310cfec3cda126f75f3c51b94dbcdd8f66509bd0112f
Instruction Fuzzy Hash: 7111F730E0020EDEDF24DA98ED987FCF7B6AF2125AF14112AD011A22919F7048CACB15

Uniqueness

Uniqueness Score: -1.00%

Function 016680F1 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39f9cdf4ad2c990e8dfbbee4206ce5cd38eeed9283f15335fa813ac0b058aca
Instruction ID: 765de1713e740891cb9eb7edc8d36ad1a593f25c304e533c4558a843d59143ad
Opcode Fuzzy Hash: c39f9cdf4ad2c990e8dfbbee4206ce5cd38eeed9283f15335fa813ac0b058aca
Instruction Fuzzy Hash: DD016770911149AFDB01EFB9E950ADCBFB1EF40304F5046B9C805A7269DB355F49DB82

Uniqueness

Uniqueness Score: -1.00%

Function 01661524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f04d171f5a9d0063a0fd27de036404c57f9c25c39726f0132debcce86de4dd
Instruction ID: f8ecfce631240f1152c2da9f21d2cbf4ea96a5d16a80d287397db6ee01847823
Opcode Fuzzy Hash: d7f04d171f5a9d0063a0fd27de036404c57f9c25c39726f0132debcce86de4dd
Instruction Fuzzy Hash: 02F0F672A041508FD7228BA88C911ACFB69EAEA15175D40E7D802DB311D735D542C751

Uniqueness

Uniqueness Score: -1.00%

Function 01667090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9472e21015e99cc72609259139c32318c21c7c5f47ddb8d06e46ee6d77457d
Instruction ID: f54b729d12a588f7bfbb0d96f8f9108747e1862d2c65715a96e475bb27d47358
Opcode Fuzzy Hash: df9472e21015e99cc72609259139c32318c21c7c5f47ddb8d06e46ee6d77457d
Instruction Fuzzy Hash: B4F0C439B40208CFC714DB68D998A6DB7B2EF886A5F5044A8E506DB3A0DB35AD52CB41

Uniqueness

Uniqueness Score: -1.00%

Function 01668100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2877086667.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d417f108bbd15b308fc422152756618a56721ee6e7d36299e4f9454b6202306
Instruction ID: d7df3613eadc971a701ebfd7c177ee33bce27e10e82d2f9bb3ab75967cccd3a9
Opcode Fuzzy Hash: 0d417f108bbd15b308fc422152756618a56721ee6e7d36299e4f9454b6202306
Instruction Fuzzy Hash: 55F0F470911109AFCB00FFA9F950ADDBBB5EF40304F5046B9C805A7268DF756F499B92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe

Function 04F96C10 Relevance: 31.7, Strings: 23, Instructions: 2915
COMMON

Function 0288B1D0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 028858EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 04F91284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 028844E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02885A64 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Function 0288D238 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0288D6A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0288AEE8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0288B641 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 0288B3C0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre