Edit tour

Windows Analysis Report
app.exe

Overview

General Information

Sample name:	app.exe
Analysis ID:	1436386
MD5:	75b9ef9142a78671d449c8d22ab6be14
SHA1:	0461f1c46644acde8020bb59b53b1e34b65977ca
SHA256:	e9bc44cf548a70e7285499209973faf44b7374dece1413dfcdc03bf25a6c599c
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Contains functionality to infect the boot sector

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Self deletion via cmd or bat file

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

app.exe (PID: 7652 cmdline: "C:\Users\user\Desktop\app.exe" MD5: 75B9EF9142A78671D449C8D22AB6BE14)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

app.exe (PID: 7132 cmdline: "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe" MD5: 75B9EF9142A78671D449C8D22AB6BE14)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1808 cmdline: cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

timeout.exe (PID: 1172 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Snort Signatures

ET TROJAN Win32/FireStealer Related Server Response - Source IP: 144.208.127.230 - Destination IP: 192.168.11.20

Timestamp:	05/05/24-00:24:50.450010
SID:	2051909
Source Port:	80
Destination Port:	49789
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.ipify.org

Source: app.exe, 00000003.00000003.3182148991.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: app.exe, 00000003.00000003.3182148991.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 451Host: 144.208.127.230

Source: app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230
Source: app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.0000000000950000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000091F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3141697165.000000000559A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246373817.000000000094A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242018626.0000000005596000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3185017394.0000000005596000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3099980672.0000000000950000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3262410113.0000000005596000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3137031558.000000000558E000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3125985144.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3099980672.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246373817.0000000000950000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.000000000094A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246373817.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005591000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3101657336.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/7
Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103448637.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/B
Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/J
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/U
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/Y
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/e&
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/v
Source: app.exe, 00000003.00000003.3246373817.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/z
Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/~
Source: app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/
Source: app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3101845651.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103619876.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/-35b871f0a661
Source: app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/-35b871f0a661ozi
Source: app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/L
Source: app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/R
Source: app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/T
Source: app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/o
Source: app.exe, 00000003.00000003.3139260264.0000000005588000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123698644.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3134624186.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3125985144.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3139068962.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3136784723.0000000005586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/w
Source: app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230U
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: app.exe, 00000003.00000002.3295913444.0000000002530000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://POSTHTTP/1.1Content-Type:
Source: app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Abuse?mkt=EN-US&uiflavor=web&client_id=1E000040382627&id=293577&lmif=40&abr
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.office.com/office/url/setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.office.com/office/url/setupMicrosoft
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alldrivers4devices.net
Source: app.exe, 00000003.00000003.3246373817.000000000090A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3093090885.0000000000913000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3092789933.000000000091F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3294569055.000000000090A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3093090885.0000000000904000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://consent.trustarc.com
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: app.exe, 00000003.00000002.3297646985.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3292208873.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encrypted-tbn0.gstatic.com/licensed-image?q=tbn:ANd9GcRJX35jqtu8qT267s2bDnzhp-lJVMQdhF5S6U4t
Source: app.exe, 00000003.00000002.3297646985.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3292208873.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encrypted-tbn0.gstatic.com/licensed-image?q=tbn:ANd9GcRgJaQoM7DXWRt-dg7YoOenavsVCx2_mgiT8oFn
Source: app.exe, 00000003.00000002.3297646985.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3292208873.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encrypted-tbn0.gstatic.com/licensed-image?q=tbn:ANd9GcSFe5-1ue4YewDL7QTtYG5GBPfUy7h9iJ7t-0kd
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
Source: app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh5.googleusercontent.com/p/AF1QipOvNh-L3TTVll_wDyQd66TEaShUCp3i0iabc8se=w92-h92-n-k-no
Source: app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh5.googleusercontent.com/p/AF1QipPFr704HJkdqZ5xefxGs53Btx8SeAbaCnWxa6-y=w92-h92-n-k-no
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: app.exe, 00000003.00000003.3183161453.00000000058D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/0
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1632306401&rver=7.0.6738.0&wp=M
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=77f68844-337b-4044-a0d4-153795cf9153&scope=op
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/post.srf?client_id=77f68844-337b-4044-a0d4-153795cf9153&scope=openid
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-153795cf
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: app.exe, 00000003.00000003.3182859527.00000000055F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://office.com/setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://office.com/setupMicrosoft
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recoveringlib.blogspot.com
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt/
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txtD
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com/
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com;9
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/?ms.officeurl=setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/?ms.officeurl=setupMicrosoft
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8.
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue/
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ctid=34c190b7-c610-402a-b0d1-920cecdfcf12&redirectUri=https%3A%2F%2F
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8&redirectUri=https%3A%2F%2F
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3Dsetup2V
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3DsetupSign
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8-_
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashaert
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://windows-drivers-x04.blogspot.com
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/7
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/AutoIt
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
Source: app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=at
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=autoit
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=eicar
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/setupMicrosoft

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.11.20:49788 version: TLS 1.2

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00424B38 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,

System Summary

PE file contains section with special chars

Source: app.exe	Static PE information: section name: )m&
Source: app.exe.0.dr	Static PE information: section name: )m&

PE file has a writeable .text section

Source: app.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: app.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C02D0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C77D0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025902D0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025977D0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02579E36 AcquireSRWLockExclusive,AcquireSRWLockExclusive,NtDeviceIoControlFile,RtlNtStatusToDosError,AcquireSRWLockExclusive,AcquireSRWLockExclusive,AcquireSRWLockExclusive,AcquireSRWLockExclusive,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0040A44A: GetCurrentProcess,SetPriorityClass,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_004092DE
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00404358
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040941D
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040964F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040A770
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00407703
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_004077F6
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00409A38
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00412AC0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00425B56
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00407DBE
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00404E54
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00418E0E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257A020
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D91D2
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025801BB
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025BE5F7
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0259AA16
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02583ABA
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D1862
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02591E40
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0259BD08
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D3239
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A3224
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A0225
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B72D7
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C42F5
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A628E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025CF340
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D430E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02566320
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D632B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A53DD
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025ED3D0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025DD3C0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258C38E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025E3389
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F13BD
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A3001
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025BE030
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D20E3
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257B090
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EE16F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025AB13B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02563130
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256B1F0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B1180
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256A1B0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025811A0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02562670
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EE605
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257B695
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C0690
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025AC6AE
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02577754
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257771C
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257670C
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02563790
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02582449
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A6468
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02563400
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B74D0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B34D6
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256B4C0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EF4C2
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256E490
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A4544
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D352A
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025985C9
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D85F4
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02598A44
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A4A88
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258BAB0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02586B58
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A2B5E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02561B50
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256BB50
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D1B40
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258DB7B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258EB69
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B6B1B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EBB18
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256AB90
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0259585F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025ED844
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256F8EC
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D3890
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025648A0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B98A5
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02569950
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02573962
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257799F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C1E40
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F0E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_0552C3BF
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02570225
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255C38E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A91D2
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025501BB
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025511A0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0258E5F7
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0256AA16
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02574A88
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02553ABA
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02556B58
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255DB7B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255EB69
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0256585F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A1862
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025898A5
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02561E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255AE37
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02557C6F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02553C05
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02584D4A
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0256BD08
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A3239
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02573224
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025872D7
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025942F5
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257628E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0259F340
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A430E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A632B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02536320
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025753DD
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BD3D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025AD3C0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025B3389
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C13BD
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02573001
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0258E030
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254A020
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A20E3
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254B090
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BE16F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02533130
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257B13B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253B1F0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02581180
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253A1B0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02532670
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BE605
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254B695
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02590690
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257C6AE
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02547754
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254771C
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254670C
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02533790
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02552449
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02576468
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02533400
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025874D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025834D6
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253B4C0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BF4C2
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253E490
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02574544
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A352A
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025685C9
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A85F4
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02568A44
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255BAB0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02531B50
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253BB50
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02572B5E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A1B40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BBB18
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586B1B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253AB90
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BD844
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253F8EC
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A3890
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025348A0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02539950
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02543962
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254799F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02591E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C0E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02587E74
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02579E36
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02536EC0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586ECC
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02557EF1
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257DEE0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586F5B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257CF7C
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02542F21
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02542C6E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02580C00
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02567C09
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A5CD3
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586CC5
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BDCE6
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02532C90
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02557CA3
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BFCA7
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02572D42
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02577D14
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02578D25
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02594DD0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586DD2

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe E9BC44CF548A70E7285499209973FAF44B7374DECE1413DFCDC03BF25A6C599C

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 025BCAF0 appears 156 times
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 02533D50 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 025ADE90 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 025BC9A0 appears 60 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 00416398 appears 132 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 025ECAF0 appears 112 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 00416EF8 appears 50 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 025EC9A0 appears 45 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 02563D50 appears 73 times

Source: app.exe, 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs app.exe
Source: app.exe, 00000003.00000000.2681579898.000000000044D000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename vs app.exe
Source: app.exe	Binary or memory string: OriginalFilename vs app.exe
Source: app.exe.0.dr	Binary or memory string: OriginalFilename vs app.exe

Source: app.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: app.exe.0.dr	Binary string: Could not open \device\physicalmemory
Source: app.exe.0.dr	Binary string: Could not map view of %X length %XCould not open \device\physicalmemory\device\physicalmemoryRtlNtStatusToDosErrorNtMapViewOfSectionNtOpenSectionNtUnmapViewOfSectionntdll.dllRtlInitUnicodeString%c

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@10/6@1/2

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_025C2A50 GetModuleHandleW,FormatMessageW,GetLastError,HeapFree,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0040A130 GetVersionExA,CoCreateInstance,CoSetProxyBlanket,VariantInit,lstrlenW,lstrcpynA,WideCharToMultiByte,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00423119 EnableWindow,GetActiveWindow,SetActiveWindow,FreeResource,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5108:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Mutant created: \Sessions\1\BaseNamedObjects\hrzbaov

Source: C:\Users\user\Desktop\app.exe

File created: C:\Users\user\AppData\Local\Temp\7041956494665639546

Jump to behavior

Source: app.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\app.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\app.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: app.exe, 00000003.00000003.3188734917.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr

Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: app.exe

Virustotal: Detection: 11%

Source: C:\Users\user\Desktop\app.exe

File read: C:\Users\user\Desktop\app.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\app.exe "C:\Users\user\Desktop\app.exe"
Source: C:\Users\user\Desktop\app.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\app.exe	Process created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\app.exe	Process created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5

Source: C:\Users\user\Desktop\app.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: oledlg.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\app.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: edgegdi.dll

Source: C:\Users\user\Desktop\app.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: app.exe

Static file information: File size 1290240 > 1048576

Source:	Binary string: SRLPR.pdBf source: app.exe, 00000003.00000003.3101475941.00000000055E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3127769261.00000000055F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: grabg::C:\\Users\\user\\Desktop\\GQSZOBXUFX\\RMDIWSRLPR.pdBfGbodyFUk1ESVdTU source: app.exe, 00000003.00000003.3101475941.00000000055E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GQSZOBXUFX\\RMDIWSRLPR.pdBfIbodyHUk1ESVdTU source: app.exe, 00000003.00000003.3127769261.00000000055F6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\app.exe	Unpacked PE file: 0.2.app.exe.2560000.2.unpack
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Unpacked PE file: 3.2.app.exe.2530000.2.unpack

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0042C59F VirtualAlloc,VirtualAlloc,LoadLibraryA,GetProcAddress,

Source: app.exe	Static PE information: section name: )m&
Source: app.exe.0.dr	Static PE information: section name: )m&

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00416398 push eax; ret
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00415460 push eax; ret
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00415460 push eax; ret
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0047EC7F push FFFFFFA1h; retf
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00416F33 push ecx; ret
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F23AD push es; iretd
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EC6A1 push ecx; ret
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F3881 push eax; ret
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F691F push eax; ret
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_0552C6D7 push cs; iretd
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_055288A8 pushad ; iretd
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_05E6B3EB push ss; retf
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_05E6B3EB push ss; retf
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C23AD push es; iretd
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BC6A1 push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C3881 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C691F push eax; ret

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d

Source: C:\Users\user\Desktop\app.exe

File created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00401660 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040CFF1 IsIconic,GetWindowPlacement,GetWindowRect,

Source: C:\Users\user\Desktop\app.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\app.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Memory
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_SMBIOSMemory
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryArray
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryDevice
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_CacheMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Memory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_SMBIOSMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryArray
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryDevice
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_CacheMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00408FF2 rdtsc

Source: C:\Users\user\Desktop\app.exe

Code function: LoadLibraryA,FreeLibrary,GetAdaptersInfo,GetAdaptersInfo,

Source: C:\Users\user\Desktop\app.exe	API coverage: 2.6 %
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	API coverage: 8.1 %

Source: C:\Users\user\Desktop\app.exe TID: 1440	Thread sleep count: 53 > 30
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe TID: 6904	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe TID: 1588	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 1928	Thread sleep count: 39 > 30

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00427361 GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025CA710 CloseHandle,FindFirstFileW,FindClose,HeapFree,HeapFree,HeapFree,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025E4B93 FindFirstFileExW,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0259A710 CloseHandle,FindFirstFileW,FindClose,HeapFree,HeapFree,HeapFree,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0259FEC0 HeapFree,HeapFree,HeapFree,HeapFree,FindFirstFileW,HeapFree,HeapFree,GetLastError,HeapFree,HeapFree,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025B4B93 FindFirstFileExW,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0041E91D VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3092789933.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3098259663.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3099980672.0000000000956000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00408FF2 rdtsc

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_025E44E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0042C59F VirtualAlloc,VirtualAlloc,LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_025CD430 GetProcessHeap,RtlAllocateHeap,

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0041B198 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0041B1AC SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256EAC0 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetLastError,HeapFree,HeapFree,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025DE0C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025E44E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253EAC0 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetLastError,HeapFree,HeapFree,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025AE0C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025B44E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025ADC6E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025ADDCA SetUnhandledExceptionFilter,

Source: C:\Users\user\Desktop\app.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\app.exe	Process created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00409127 cpuid

Source: C:\Users\user\Desktop\app.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,
Source: C:\Users\user\Desktop\app.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\Desktop\app.exe	Code function: lstrcpyA,wsprintfA,LoadLibraryA,GetLocaleInfoA,

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\3D Objects VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ElevatedDiagnostics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Intel VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Mozilla VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PeerDistRepub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Publishers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\VirtualStore VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Adobe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Intel VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Mozilla VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sun VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Acrobat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Flash Player VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Headlights VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Linguistics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\LogTransport2 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\AddIns VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Credentials VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Excel VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\MMC VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Network VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Protect VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Vault VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\SystemExtensionsDev VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sun\Java VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Contacts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Contacts\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Contacts\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\container.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\container.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\AFWAAFRXKO VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\app.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\app.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\IVHSHTCODI VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\JDSOXXXWOA VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\PSAMNLJHZW VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Word.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Word.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\AFWAAFRXKO VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\JDSOXXXWOA VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos\Captures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\PSAMNLJHZW VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\autoit-v3-setup.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\autoit-v3-setup.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\eicar.com.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\eicar.com.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\eicar.com.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\FACWLRWHGG.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\IVHSHTCODI.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\JPEAFKFPZY.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\OfficeSetup.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\OfficeSetup.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\XQACHMZIHU.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Amazon.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Bing.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Bing.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Facebook.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Google.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Links VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Links\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Links\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Live.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\NYTimes.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Reddit.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Reddit.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Wikipedia.url VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Brighten Video.man.igpi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Brighten Video.man.igpi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\BRIGHT~1.IGP VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\BRIGHT~1.IGP VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Darken Video.man.igpi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Darken Video.man.igpi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\DARKEN~1.IGP VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\DARKEN~1.IGP VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Enhance Video Colors.man.igpi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Enhance Video Colors.man.igpi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\ENHANC~1.IGP VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\ENHANC~1.IGP VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\Desktop.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\Desktop.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\Downloads.lnk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\ARM VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\Color VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ElevatedDiagnostics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PeerDistRepub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Publishers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\_curlrc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms\Unistore VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms\UnistoreDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469.cdp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469.cdp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache\3534848bb9f4cb71 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache\cb00da9ba77862e VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ElevatedDiagnostics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google\CrashReports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Software Reporter Tool VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History\Low VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Intel\CUIPromotions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Intel\Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\EdgeBho VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\GameDVR VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\InputPersonalization VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Internet Explorer VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\OneDrive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\PlayReady VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\XboxLive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\ActiveSync VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.1_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.6_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.7_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAppRuntime.1.2_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PeerDistRepub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Publishers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0353475199 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0487075091 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0615447233 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0615447233 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0666563528 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0666563528 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0825612946 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0887538035 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0939541263 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0939541263 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1169381505 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1244065654 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1287572840 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1287572840 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1343496627 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1343496627 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1387277564 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1387277564 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1417002460 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2165547404 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2165547404 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2265332024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2265465471 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2874006916 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3677062445 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrord32_sbx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B018D45B-96A4-4B60-BED4-BC78D47B50F2 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Importer_6_Default_4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Low VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MpCmdRun.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MpCmdRun.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TCDE6D1.tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TCDE6EA.tmp VolumeInformation

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0041C882 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0041DD1B GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00415DDE EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Electrum\wallets\tjYCo5b
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Electrum\wallets\tjYCo5b
Source: app.exe, 00000003.00000003.3098259663.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"AtomicWallet","path":"%APPDATA%\\atomic\\Local Storage\\leveldb\\"},{"name":"Exodus","path":"%APPDATA%\\exodus\\exodus.wallet\\"},{"name":"JaxxWallet","path":"%APPDATA%\\Wallets\\Jaxx\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\"},{"
Source: app.exe, 00000003.00000003.3098259663.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"AtomicWallet","path":"%APPDATA%\\atomic\\Local Storage\\leveldb\\"},{"name":"Exodus","path":"%APPDATA%\\exodus\\exodus.wallet\\"},{"name":"JaxxWallet","path":"%APPDATA%\\Wallets\\Jaxx\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\"},{"
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\XdPr
Source: app.exe, 00000003.00000003.3292397056.000000000556B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\XdPr
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Coinomi\Coinomi\wallets\
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\exodus\exodus.wallet\Y
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\XdPr

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\Local Settings\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\Local Settings\Mozilla\Firefox\Profiles\kzpbmws1.default\key4.db

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Bootkit	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	45 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	461 Security Software Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	2 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
app.exe	11%	ReversingLabs
app.exe	100%	Joe Sandbox ML
app.exe	11%	Virustotal	Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	11%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://144.208.127.230/J	0%	Avira URL Cloud	safe
http://144.208.127.230/v	0%	Avira URL Cloud	safe
http://144.208.127.230:80/w	0%	Avira URL Cloud	safe
http://144.208.127.230/	0%	Avira URL Cloud	safe
http://144.208.127.230/z	0%	Avira URL Cloud	safe
http://144.208.127.230/z	0%	Virustotal		Browse
http://144.208.127.230	0%	Avira URL Cloud	safe
http://144.208.127.230/B	0%	Avira URL Cloud	safe
http://144.208.127.230/J	0%	Virustotal		Browse
http://144.208.127.230/	0%	Virustotal		Browse
http://144.208.127.230:80/w	0%	Virustotal		Browse
http://144.208.127.230/Y	0%	Avira URL Cloud	safe
http://144.208.127.230/U	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
http://144.208.127.230:80/	0%	Avira URL Cloud	safe
http://144.208.127.230:80/-35b871f0a661	0%	Avira URL Cloud	safe
http://144.208.127.230:80/L	0%	Avira URL Cloud	safe
http://144.208.127.230	0%	Virustotal		Browse
http://144.208.127.230/7	0%	Avira URL Cloud	safe
http://144.208.127.230:80/	0%	Virustotal		Browse
http://144.208.127.230/Y	0%	Virustotal		Browse
https://POSTHTTP/1.1Content-Type:	0%	Avira URL Cloud	safe
http://144.208.127.230/e&	0%	Avira URL Cloud	safe
https://alldrivers4devices.net	0%	Avira URL Cloud	safe
http://144.208.127.230:80/o	0%	Avira URL Cloud	safe
http://144.208.127.230/7	0%	Virustotal		Browse
http://144.208.127.230/~	0%	Avira URL Cloud	safe
http://144.208.127.230:80/T	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://144.208.127.230:80/-35b871f0a661ozi	0%	Avira URL Cloud	safe
http://144.208.127.230:80/R	0%	Avira URL Cloud	safe
http://144.208.127.230:80/T	0%	Virustotal		Browse
http://144.208.127.230U	0%	Avira URL Cloud	safe
http://144.208.127.230/~	0%	Virustotal		Browse
https://alldrivers4devices.net	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://144.208.127.230/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Web Data.3.dr	false		high
https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://windows-drivers-x04.blogspot.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8-_	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://consent.trustarc.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/z	app.exe, 00000003.00000003.3246373817.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://144.208.127.230:80/w	app.exe, 00000003.00000003.3139260264.0000000005588000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123698644.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3134624186.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3125985144.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3139068962.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3136784723.0000000005586000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://144.208.127.230/v	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/SignIn?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8&redirectUri=https%3A%2F%2F	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com;9	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/J	app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.eicar.org/download-anti-malware-testfile/:	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://office.com/setup	app.exe, 00000003.00000003.3182859527.00000000055F1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/B	app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103448637.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lh5.googleusercontent.com/p/AF1QipOvNh-L3TTVll_wDyQd66TEaShUCp3i0iabc8se=w92-h92-n-k-no	app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230	app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/search?q=at	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/Y	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com.txtD	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Abuse?mkt=EN-US&uiflavor=web&client_id=1E000040382627&id=293577&lmif=40&abr	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lh5.googleusercontent.com/p/AF1QipPFr704HJkdqZ5xefxGs53Btx8SeAbaCnWxa6-y=w92-h92-n-k-no	app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/U	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/?ms.officeurl=setup	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/	app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://recoveringlib.blogspot.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/-35b871f0a661	app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3101845651.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103619876.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://aka.office.com/office/url/setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/L	app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.eicar.org/eicar.com	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.office.com/office/url/setup	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3DsetupSign	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/7	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/search?q=autoit	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.3.dr	false		high
https://setup.office.com/?ms.officeurl=setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://POSTHTTP/1.1Content-Type:	app.exe, 00000003.00000002.3295913444.0000000002530000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://144.208.127.230/e&	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.eicar.org/eicar.com.txt/	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/search?q=eicar	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com/	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-153795cf	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/setup	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3Dsetup2V	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/favicon.ico	app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://alldrivers4devices.net	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://office.com/setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flashaert	app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.eicar.org/download-anti-malware-testfile/Download	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8.	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue/	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/o	app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/SignIn?ctid=34c190b7-c610-402a-b0d1-920cecdfcf12&redirectUri=https%3A%2F%2F	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/site/autoit/downloads/AutoIt	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/~	app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://144.208.127.230:80/T	app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.208.127.230:80/-35b871f0a661ozi	app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.208.127.230:80/R	app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230U	app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://secure.eicar.org/eicar.com.txt	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/site/autoit/downloads/7	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
144.208.127.230	unknown	United States		395092	SHOCK-1US	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436386
Start date and time:	2024-05-05 00:21:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	app.exe
Detection:	MAL
Classification:	mal100.spyw.evad.winEXE@10/6@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
HTTP Packets have been reduced
TCP Packets have been reduced to 100
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:24:47	API Interceptor	49x Sleep call for process: app.exe modified

Process:	C:\Users\user\Desktop\app.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1290240
Entropy (8bit):	7.441704402192102
Encrypted:	false
SSDEEP:	24576:CIFxe+AY3rqYsavMOQdbac5IQH97wiI3dzAr09UDZ5YUD8:1xeSNR0vbac5/d8P3diDZ6q
MD5:	75B9EF9142A78671D449C8D22AB6BE14
SHA1:	0461F1C46644ACDE8020BB59B53B1E34B65977CA
SHA-256:	E9BC44CF548A70E7285499209973FAF44B7374DECE1413DFCDC03BF25A6C599C
SHA-512:	14EF889F580C02E319B6D9D899DDBD1BD523C1D8B493EAB8B98DA6D3D276D76EFB9B5694759DF7D68BB9D002A8ACE8FC82D22121A7B4EA236D5F9CEF38CC809C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11% Antivirus: Virustotal, Detection: 11%, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........P(..>{..>{..>{?.c{..>{v..{..>{...{..>{f."{..>{e."{..>{F.'{..>{..?{..>{F.~{..>{F."{&.>{...{..>{..5{..>{..^{..>{F.#{.>{F.{{..>{F..{..>{Rich..>{................PE..L......P.............................]............@.......................... ..............................................$........................................................................................................................text...2........................... ....rdata...&.......0..................@..@.data........ ...@... ..............@....rsrc................`..............@..@)m&......P.......P...`.................@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\app.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\Cookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x9, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	1.5161495002712742
Encrypted:	false
SSDEEP:	96:s3n5HGsht8kAM0hsYfxqYgXZBqIcsrl3tuY2sWsqF:c5mF5wnpx9uYSF
MD5:	16A6EDF5F48F2A7B20B3B8825384B05C
SHA1:	A59542299A41166F515B18AB8CBC3D72517ED207
SHA-256:	3E1A2BB358B396C201A6058EC8A05E25B167255EB3DAEEB1130331A298CC6F93
SHA-512:	7C4C9D69B05EA5B120C0DB6DF7D0C4487387659AF6D17C387503CA360EF8430F676B0964B6BC3C368BA4DC8D0E648B2750C26970D833788982BBF5BC04AC632D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`..=......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\History

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 4, database pages 35, cookie 0x1e, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.44975538801868414
Encrypted:	false
SSDEEP:	96:Ou1HAU+bDoYysX0uhnyZtha58VjN9DLjGQLBE3u:Ou1X+bDo3irhnyBi8Vj3XBBE3u
MD5:	89E4498D0328AFC71113CC75EBE7D770
SHA1:	120CF58C897FF1025F8B4F854A21821D948F74BC
SHA-256:	F50B271AFE0D4950FAE539E4A04C3D07849F0CE2250E73B352CDB3D981095B40
SHA-512:	7914EDF9352FBB1ABB6A0B89A4F47F09DE5672DEB6B4BE9EBEA833C8D1ED3EFD5AD16A612DF3DF65C878EB577FD0B697BC44C3E52D9BBFB82A81C1C903621989
Malicious:	false
Preview:	SQLite format 3......@ .......#..................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Login Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 27, 1st free page 7, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.7310370201569906
Encrypted:	false
SSDEEP:	96:qsvKLyeymO9K3PlGNxotxPUCbn8MouON3n:q86PlGNxss27e
MD5:	A802F475CA2D00B16F45FEA728F2247C
SHA1:	AF57C02DA108CFA0D7323252126CC87D7B608786
SHA-256:	156ADDC0B949718CF518720E5774557B134CCF769A15E0413ABC257C80E58684
SHA-512:	275704B399A1C236C730F4702B57320BD7F034DC234B7A820452F8C650334233BD6830798446664F133BA4C77AA2F91E66E901CE8A11BD8575C2CD08AB9BE98F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1414673161713362
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
MD5:	24937DB267D854F3EF5453E2E54EA21B
SHA1:	F519A77A669D9F706D5D537A203B7245368D40CE
SHA-256:	369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
SHA-512:	AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
Malicious:	false
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.441704402192102
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	app.exe
File size:	1'290'240 bytes
MD5:	75b9ef9142a78671d449c8d22ab6be14
SHA1:	0461f1c46644acde8020bb59b53b1e34b65977ca
SHA256:	e9bc44cf548a70e7285499209973faf44b7374dece1413dfcdc03bf25a6c599c
SHA512:	14ef889f580c02e319b6d9d899ddbd1bd523c1d8b493eab8b98da6d3d276d76efb9b5694759df7d68bb9d002a8ace8fc82d22121a7b4ea236d5f9cef38cc809c
SSDEEP:	24576:CIFxe+AY3rqYsavMOQdbac5IQH97wiI3dzAr09UDZ5YUD8:1xeSNR0vbac5/d8P3diDZ6q
TLSH:	8255CF05F3D2B8B1D15192772DC96161B6ED993048D83F0732D0EE5E1B3B9A6B40FE2A
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........P(..>{..>{..>{?.c{..>{v..{..>{...{..>{f."{..>{e."{..>{F.'{..>{..?{..>{F.~{..>{F."{&.>{...{..>{..5{..>{..^{..>{F.#{..>{F.{{..>

File Icon


Icon Hash:	0f4ecda7ae5d1715

Static PE Info

General

Entrypoint:	0x415dde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x500F9507 [Wed Jul 25 06:41:11 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	26600adf486f72b556f917a64c8fd23f

Entrypoint Preview

Instruction
push 00000060h
push 0043A478h
call 00007F8C48B70DE3h
mov edi, 00000094h
mov eax, edi
call 00007F8C48B6F33Fh
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [0042F2B4h]
mov ecx, dword ptr [esi+10h]
mov dword ptr [0044B190h], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [0044B19Ch], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [0044B1A0h], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [0044B194h], esi
cmp ecx, 02h
je 00007F8C48B6FCDEh
or esi, 00008000h
mov dword ptr [0044B194h], esi
shl eax, 08h
add eax, edx
mov dword ptr [0044B198h], eax
xor esi, esi
push esi
mov edi, dword ptr [0042F20Ch]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F8C48B6FCF1h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F8C48B6FCE4h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F8C48B6FCF1h
cmp eax, 0000020Bh
je 00007F8C48B6FCD7h
mov dword ptr [ebp-1Ch], esi
jmp 00007F8C48B6FCF9h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F8C48B6FCC4h
xor eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007F8C48B6FCE0h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F8C48B6FCB4h
xor eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[ASM] VS2002 (.NET) build 9466
[ C ] VS2002 (.NET) build 9466
[C++] VS2003 (.NET) build 3077
[C++] VS2002 (.NET) build 9466
[RES] VS2002 (.NET) build 9466
[LNK] VS2002 (.NET) build 9466

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f924	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x2f5f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x594	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2db32	0x2e000	7868e2f41e5b3ab908ac5a72a66f5953	False	0.6095076851222826	data	6.670624963209676	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2f000	0x126c6	0x13000	efd458d4cde7206fd4c5482997a30ba9	False	0.4482421875	data	5.736665908168061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x42000	0xa9f4	0x4000	07b79e131c84ddfb0842641915843ec1	False	0.4459228515625	data	5.072911159589167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x2f5f0	0x30000	2686df77c23e2ca3144ababd1a5e1501	False	0.2823994954427083	data	4.484521144858898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
)m&	0x7d000	0xc5000	0xc5000	acab40631ef6f655b384348be6aac2b9	False	0.841724996034264	data	7.775469163423906	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
JPG	0x4f2b0	0x2b1e6	PC bitmap, Windows 3.x format, 635 x 276 x 8, cbSize 176614, bits offset 1078	Chinese	China	0.27774128891254374
RT_CURSOR	0x7a498	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x7a5d0	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x7a6b0	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x7a800	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x7a950	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x7aaa0	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x7abf0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x7ad40	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x7ae90	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x7afe0	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x7b130	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x7b280	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x7b3d0	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x7b520	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x7b670	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x7b7c0	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x7b9f8	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x7bab0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x4db70	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.6042418772563177
RT_ICON	0x4e430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.6042418772563177
RT_DIALOG	0x4ecf0	0x23e	data	Chinese	China	0.5174216027874564
RT_DIALOG	0x4ef30	0x94	data	Chinese	China	0.6959459459459459
RT_DIALOG	0x7b910	0xe2	data	Chinese	China	0.6637168141592921
RT_STRING	0x7bbf8	0x46	data	Chinese	China	0.6857142857142857
RT_STRING	0x7bc40	0x54	data	Chinese	China	0.8571428571428571
RT_STRING	0x7bc98	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x7bcc8	0x74	data	Chinese	China	0.8448275862068966
RT_STRING	0x7bd40	0x1d0	data	Chinese	China	0.8060344827586207
RT_STRING	0x7c088	0x164	data	Chinese	China	0.48314606741573035
RT_STRING	0x7bf50	0x132	data	Chinese	China	0.6405228758169934
RT_STRING	0x7c570	0x50	data	Chinese	China	0.725
RT_STRING	0x7bf10	0x40	data	Chinese	China	0.65625
RT_STRING	0x7c4d8	0x6a	data	Chinese	China	0.7452830188679245
RT_STRING	0x7c1f0	0x1d6	data	Chinese	China	0.6723404255319149
RT_STRING	0x7c3c8	0x110	data	Chinese	China	0.625
RT_STRING	0x7c548	0x24	data	Chinese	China	0.4444444444444444
RT_STRING	0x7c5c0	0x30	data	Chinese	China	0.625
RT_GROUP_CURSOR	0x7a688	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x7ae78	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7a7e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7ad28	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7abd8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b508	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7aa88	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b118	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7a938	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7afc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b268	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b3b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b658	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b7a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b8f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x4e418	0x14	data	Chinese	China	1.15
RT_GROUP_ICON	0x4ecd8	0x14	data	Chinese	China	1.25
RT_VERSION	0x4efc8	0x2e8	data	Chinese	China	0.5631720430107527

Imports

DLL	Import
KERNEL32.dll	LockFile, UnlockFile, SetEndOfFile, DuplicateHandle, FindClose, FindFirstFileA, GetFullPathNameA, GetCPInfo, GetOEMCP, FileTimeToSystemTime, SetErrorMode, FileTimeToLocalFileTime, GetFileAttributesA, GetFileTime, GetTickCount, HeapAlloc, HeapFree, RtlUnwind, GetStartupInfoA, GetCommandLineA, RaiseException, GetSystemTimeAsFileTime, ExitProcess, TerminateProcess, HeapReAlloc, HeapSize, FlushFileBuffers, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, GetCurrentProcessId, LCMapStringA, LCMapStringW, GetTimeZoneInformation, IsBadReadPtr, IsBadCodePtr, VirtualProtect, GetSystemInfo, VirtualQuery, SetStdHandle, SetEnvironmentVariableA, SetFilePointer, GlobalFlags, WritePrivateProfileStringA, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, TlsGetValue, EnterCriticalSection, GlobalHandle, GlobalReAlloc, LeaveCriticalSection, LocalAlloc, GlobalGetAtomNameA, GlobalFindAtomA, lstrcatA, lstrcmpW, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, GlobalDeleteAtom, lstrcmpA, ConvertDefaultLocale, EnumResourceLanguagesA, lstrcpyA, SetLastError, GlobalFree, MulDiv, GlobalAlloc, GlobalLock, GlobalUnlock, GetModuleHandleA, GetProcAddress, FormatMessageA, LocalFree, CopyFileA, GetCurrentDirectoryA, FreeResource, OpenFile, GetCurrentProcess, SetPriorityClass, lstrcpynA, DeviceIoControl, ReadFile, GetFileSize, GetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, GetSystemDirectoryA, CreateFileA, WriteFile, CloseHandle, DeleteFileA, GetModuleFileNameA, LoadLibraryA, FreeLibrary, GetVolumeInformationA, OutputDebugStringA, DebugBreak, InterlockedIncrement, InterlockedDecrement, FindResourceA, LoadResource, LockResource, SizeofResource, lstrlenA, lstrcmpiA, CompareStringW, lstrlenW, CompareStringA, GetVersion, WideCharToMultiByte, MultiByteToWideChar, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, HeapDestroy, InterlockedExchange
USER32.dll	InvalidateRgn, SetCapture, ReleaseCapture, GetNextDlgGroupItem, MessageBeep, RegisterClipboardFormatA, PostThreadMessageA, GetForegroundWindow, GetTopWindow, UnhookWindowsHookEx, GetMessagePos, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, GetSysColor, AdjustWindowRectEx, EqualRect, GetClassInfoA, RegisterClassA, UnregisterClassA, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, SetWindowLongA, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, CopyRect, PtInRect, GetWindow, SetWindowContextHelpId, MapDialogRect, SetWindowPos, GetDesktopWindow, SetActiveWindow, EndPaint, DestroyWindow, IsWindow, InvalidateRect, GetNextDlgTabItem, EndDialog, SetMenuItemBitmaps, GetFocus, ModifyMenuA, EnableMenuItem, CheckMenuItem, GetMenuCheckMarkDimensions, LoadBitmapA, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, GetParent, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, SetCursor, PostMessageA, PostQuitMessage, wsprintfA, GetMenuState, GetMenuItemID, GetMenuItemCount, CharLowerA, CharUpperA, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, GetSubMenu, MessageBoxA, CharNextA, wvsprintfA, GetSystemMetrics, LoadIconA, EnableWindow, GetClientRect, IsIconic, GetSystemMenu, SendMessageA, AppendMenuA, CopyAcceleratorTableA, SetRect, IsRectEmpty, DrawIcon, LoadCursorA, GetDlgItem, GetSysColorBrush, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, DestroyMenu, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, RegisterWindowMessageA, WinHelpA, GetCapture, CreateWindowExA, GetClassLongA, GetClassInfoExA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SendDlgItemMessageA, SetFocus, IsChild, GetWindowTextLengthA, CreateDialogIndirectParamA, GetWindowTextA, GetMessageTime
GDI32.dll	SetMapMode, DeleteObject, GetViewportExtEx, GetWindowExtEx, PtVisible, RectVisible, TextOutA, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, DeleteDC, GetStockObject, GetBkColor, GetTextColor, CreateRectRgnIndirect, GetRgnBox, GetMapMode, RestoreDC, SaveDC, ExtTextOutA, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateBitmap, GetDeviceCaps
comdlg32.dll	GetFileTitleA
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesA, OpenPrinterA
ADVAPI32.dll	RegEnumKeyA, RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegCloseKey, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegOpenKeyA
COMCTL32.dll
SHLWAPI.dll	PathFindExtensionA, PathFindFileNameA, PathStripToRootA, PathIsUNCA
oledlg.dll
ole32.dll	CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoTaskMemAlloc, OleInitialize, OleUninitialize, CoTaskMemFree, CoCreateInstance, CoSetProxyBlanket, CoInitialize, CoUninitialize, CoRevokeClassObject, OleIsCurrentClipboard, OleFlushClipboard, CoFreeUnusedLibraries, CoRegisterMessageFilter
OLEAUT32.dll	VariantInit, SysAllocStringLen, VariantClear, VariantChangeType, SysStringLen, SysAllocStringByteLen, OleCreateFontIndirect, SystemTimeToVariantTime, SafeArrayDestroy, VariantCopy, SysAllocString, SysFreeString
iphlpapi.dll	GetAdaptersInfo
OLEACC.dll	LresultFromObject, CreateStdAccessibleObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/05/24-00:24:50.450010	TCP	2051909	ET TROJAN Win32/FireStealer Related Server Response	80	49789	144.208.127.230	192.168.11.20

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 5, 2024 00:24:47.904021978 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:47.904131889 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:47.904324055 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:47.906574965 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:47.906646967 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.118782997 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.119072914 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.120646954 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.120656013 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.120851994 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.152481079 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.196245909 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.459268093 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.459501028 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.459741116 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.460419893 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.460481882 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.460628033 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.460686922 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:50.109848976 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.215768099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.216002941 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.216104031 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.216152906 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.320934057 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.320976019 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450010061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450088978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450146914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450248957 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450306892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450361967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450412035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450428009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.450566053 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.502199888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.615658998 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.615658998 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.720161915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.720295906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.746968031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.784807920 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.784807920 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.889528036 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.913850069 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.955168009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.960611105 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.960611105 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.064706087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.089246988 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.138124943 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.138124943 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.242675066 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.273591042 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.314446926 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.344860077 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.344860077 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.449444056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.474955082 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.517565966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.581295013 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.581295013 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.685782909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.720448017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.754550934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.754550934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.859148026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.886817932 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.939325094 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.993621111 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.993621111 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.098404884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.130491972 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.173640966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.209886074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.209886074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.314246893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.350059032 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.392358065 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.440471888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.440471888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.545001030 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.572115898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.626641989 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.687793016 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.687793016 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.792337894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.820131063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.861021996 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.944320917 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.944320917 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.049401999 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.075536013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.126554966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.186395884 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.186395884 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.291074038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.317679882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.360930920 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.392790079 CEST	49789	80	192.168.11.20	144.208.127.230

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 5, 2024 00:24:47.800074100 CEST	54765	53	192.168.11.20	1.1.1.1
May 5, 2024 00:24:47.899873972 CEST	53	54765	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 5, 2024 00:24:47.800074100 CEST	192.168.11.20	1.1.1.1	0x3613	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 5, 2024 00:24:47.899873972 CEST	1.1.1.1	192.168.11.20	0x3613	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 5, 2024 00:24:47.899873972 CEST	1.1.1.1	192.168.11.20	0x3613	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 5, 2024 00:24:47.899873972 CEST	1.1.1.1	192.168.11.20	0x3613	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

144.208.127.230

Target ID:	0
Start time:	00:23:27
Start date:	05/05/2024
Path:	C:\Users\user\Desktop\app.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\app.exe"
Imagebase:	0x400000
File size:	1'290'240 bytes
MD5 hash:	75B9EF9142A78671D449C8D22AB6BE14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 7972, Parent PID: 7652

General

Target ID:	1
Start time:	00:23:27
Start date:	05/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7cb400000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: app.exePID: 7132, Parent PID: 7652

General

Target ID:	3
Start time:	00:24:07
Start date:	05/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"
Imagebase:	0x400000
File size:	1'290'240 bytes
MD5 hash:	75B9EF9142A78671D449C8D22AB6BE14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs Detection: 11%, Virustotal, Browse
Reputation:	low
Has exited:	true

Analysis Process: conhost.exePID: 7152, Parent PID: 7132

General

Target ID:	4
Start time:	00:24:07
Start date:	05/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7cb400000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 1808, Parent PID: 7132

General

Target ID:	5
Start time:	00:25:08
Start date:	05/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Imagebase:	0x90000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 5108, Parent PID: 1808

General

Target ID:	6
Start time:	00:25:08
Start date:	05/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7cb400000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: timeout.exePID: 1172, Parent PID: 1808

General

Target ID:	7
Start time:	00:25:08
Start date:	05/05/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xd40000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Disassembly

⊘No disassembly

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D04D0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,TlsSetValue,HeapFree,TlsSetValue,
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D04C0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A04D0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,TlsSetValue,HeapFree,TlsSetValue,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255EB69 HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,ReadFile,ReadFile,CloseHandle,HeapFree,HeapFree,ReadFile,ReadFile,CryptUnprotectData,CryptUnprotectData,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,ReadFile,ReadFile,HeapFree,ReadFile,ReadFile,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,ReadFile,ReadFile,GetLastError,HeapFree,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A04C0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report app.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Cookies

C:\Users\user\AppData\Local\Temp\History

C:\Users\user\AppData\Local\Temp\Login Data

C:\Users\user\AppData\Local\Temp\Web Data

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
app.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre