Edit tour

Windows Analysis Report
739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Overview

General Information

Sample name:	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Analysis ID:	1446056
MD5:	784ba798f9aa395a8ed0cd2d1e557320
SHA1:	d368d6b2507f3523702b855a19f0b6eb8380320b
SHA256:	3979eb243225878a1331722d77eeb7d5937691a9e81322bfe24f5ae23aa855f6
Tags:	AgentTeslaexeFedEx
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe (PID: 4232 cmdline: "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe" MD5: 784BA798F9AA395A8ED0CD2D1E557320)

powershell.exe (PID: 4508 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe (PID: 3160 cmdline: "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe" MD5: 784BA798F9AA395A8ED0CD2D1E557320)

skyT.exe (PID: 2036 cmdline: "C:\Users\user\AppData\Roaming\skyT\skyT.exe" MD5: 784BA798F9AA395A8ED0CD2D1E557320)

skyT.exe (PID: 1396 cmdline: "C:\Users\user\AppData\Roaming\skyT\skyT.exe" MD5: 784BA798F9AA395A8ED0CD2D1E557320)

skyT.exe (PID: 1020 cmdline: "C:\Users\user\AppData\Roaming\skyT\skyT.exe" MD5: 784BA798F9AA395A8ED0CD2D1E557320)

skyT.exe (PID: 1656 cmdline: "C:\Users\user\AppData\Roaming\skyT\skyT.exe" MD5: 784BA798F9AA395A8ED0CD2D1E557320)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.adgumrukmusavirligi.com", "Username": "gizemcevik@adgumrukmusavirligi.com", "Password": "GizCvk2019!."}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.4573886453.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.4574644878.000000000322B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 3160	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: skyT.exe PID: 2036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: skyT.exe PID: 2036	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: skyT.exe PID: 2036	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: skyT.exe PID: 1396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: skyT.exe PID: 1396	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: skyT.exe PID: 1020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: skyT.exe PID: 1020	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: skyT.exe PID: 1020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: skyT.exe PID: 1656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.skyT.exe.4558350.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.skyT.exe.4558350.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.skyT.exe.4558350.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3373a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33836:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x338c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33932:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339a4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33aca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.skyT.exe.451d730.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.skyT.exe.451d730.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.skyT.exe.451d730.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3193a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ac8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ba4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31cca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3193a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ac8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ba4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31cca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.skyT.exe.3b41b18.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.skyT.exe.3b41b18.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.skyT.exe.3b41b18.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3373a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33836:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x338c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33932:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339a4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33aca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.skyT.exe.3b41b18.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.skyT.exe.3b41b18.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.skyT.exe.3b41b18.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3193a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ac8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ba4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31cca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3193a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ac8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ba4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31cca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.skyT.exe.4558350.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.skyT.exe.4558350.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.skyT.exe.4558350.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3193a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ac8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ba4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31cca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.skyT.exe.3bb8bd0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.skyT.exe.3bb8bd0.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.skyT.exe.3bb8bd0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3373a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33836:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x338c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33932:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339a4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33aca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.skyT.exe.3bb8bd0.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.skyT.exe.3bb8bd0.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.skyT.exe.3bb8bd0.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3193a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x319ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31a36:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ac8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31b32:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ba4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31cca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.skyT.exe.451d730.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.skyT.exe.451d730.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.skyT.exe.451d730.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3373a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e35a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e3cc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33836:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e456:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x338c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e4e8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33932:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e552:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339a4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e5c4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e65a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33aca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e6ea:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3373a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33836:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x338c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33932:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339a4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33aca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3373a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e35a:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x337ac:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e3cc:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33836:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e456:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x338c8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e4e8:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33932:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e552:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339a4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e5c4:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a3a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e65a:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33aca:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e6ea:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 33 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", ParentImage: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, ParentProcessId: 4232, ParentProcessName: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", ProcessId: 4508, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\skyT\skyT.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, ProcessId: 3160, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skyT

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 94.199.206.42, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, Initiated: true, ProcessId: 3160, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 60100

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", ParentImage: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, ParentProcessId: 4232, ParentProcessName: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe", ProcessId: 4508, ProcessName: powershell.exe

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.6 - Destination IP: 94.199.206.42

Timestamp:	05/22/24-22:03:11.679391
SID:	2030171
Source Port:	60101
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.6 - Destination IP: 94.199.206.42

Timestamp:	05/22/24-22:03:11.679391
SID:	2839723
Source Port:	60101
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe

Avira: detection malicious, Label: TR/AD.GenSteal.xzcol

Found malware configuration

Source: 6.2.skyT.exe.451d730.9.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.adgumrukmusavirligi.com", "Username": "gizemcevik@adgumrukmusavirligi.com", "Password": "GizCvk2019!."}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Joe Sandbox ML: detected

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4x nop then jmp 073CBF37h	0_2_073CBC83
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 4x nop then jmp 0772B847h	6_2_0772B593
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 4x nop then jmp 06CEB847h	9_2_06CEB593

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:60101 -> 94.199.206.42:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.6:60101 -> 94.199.206.42:587

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:60100 -> 94.199.206.42:587

Source: Joe Sandbox View

IP Address: 94.199.206.42 94.199.206.42

Source: Joe Sandbox View

ASN Name: AEROTEK-ASTR AEROTEK-ASTR

Source: global traffic

TCP traffic: 192.168.2.6:60100 -> 94.199.206.42:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.adgumrukmusavirligi.com

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://adgumrukmusavirligi.com
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.adgumrukmusavirligi.com
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2136429481.000000000315D000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000006.00000002.2294417914.000000000324D000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000009.00000002.2353162012.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, skyT.exe, 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, cPKWk.cs

.Net Code: m1v5IQ8

Installs a global keyboard hook

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\skyT\skyT.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\skyT\skyT.exe

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.skyT.exe.4558350.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.skyT.exe.451d730.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.skyT.exe.3b41b18.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.skyT.exe.3b41b18.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.skyT.exe.4558350.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.skyT.exe.3bb8bd0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.skyT.exe.3bb8bd0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.skyT.exe.451d730.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, Resources.cs

Large array initialization: : array initializer size 635609

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_017CE02C	0_2_017CE02C
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073CB392	0_2_073CB392
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C8300	0_2_073C8300
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C63E8	0_2_073C63E8
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C82F0	0_2_073C82F0
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073CE120	0_2_073CE120
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C5FB0	0_2_073C5FB0
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C7EB8	0_2_073C7EB8
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C7EC8	0_2_073C7EC8
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C7A90	0_2_073C7A90
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_073C7A80	0_2_073C7A80
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B09758	4_2_02B09758
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B04AA8	4_2_02B04AA8
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B03E90	4_2_02B03E90
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B08F90	4_2_02B08F90
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B0CC18	4_2_02B0CC18
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B041D8	4_2_02B041D8
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_02B0CFC2	4_2_02B0CFC2
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C1768	4_2_062C1768
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C2F10	4_2_062C2F10
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C6DDC	4_2_062C6DDC
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C09C0	4_2_062C09C0
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C8108	4_2_062C8108
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C8103	4_2_062C8103
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C8DF7	4_2_062C8DF7
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 4_2_062C2828	4_2_062C2828
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_02FBE02C	6_2_02FBE02C
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_07728300	6_2_07728300
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_077263E8	6_2_077263E8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_077282F0	6_2_077282F0
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_07727EC8	6_2_07727EC8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_07727EB8	6_2_07727EB8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_0772DA38	6_2_0772DA38
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_07727A90	6_2_07727A90
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 6_2_07727A80	6_2_07727A80
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C591D8	7_2_02C591D8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C59628	7_2_02C59628
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C5CAE8	7_2_02C5CAE8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C54AA8	7_2_02C54AA8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C53E90	7_2_02C53E90
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C58E5C	7_2_02C58E5C
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C541D8	7_2_02C541D8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C519C0	7_2_02C519C0
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_06380448	7_2_06380448
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_063811F0	7_2_063811F0
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_06386C54	7_2_06386C54
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_06382D98	7_2_06382D98
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_063822B0	7_2_063822B0
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_06387F88	7_2_06387F88
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_06387F82	7_2_06387F82
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_06388C76	7_2_06388C76
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 7_2_02C5CE90	7_2_02C5CE90
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_026BE02C	9_2_026BE02C
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D10040	9_2_04D10040
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D1001F	9_2_04D1001F
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D1AF30	9_2_04D1AF30
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE82FB	9_2_06CE82FB
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE63E8	9_2_06CE63E8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE8300	9_2_06CE8300
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE7EC8	9_2_06CE7EC8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE7EC3	9_2_06CE7EC3
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE7EF5	9_2_06CE7EF5
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE5FB0	9_2_06CE5FB0
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE7A8B	9_2_06CE7A8B
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE7A90	9_2_06CE7A90
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CEDA38	9_2_06CEDA38
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_017E9628	10_2_017E9628
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_017ECAE8	10_2_017ECAE8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_017E4AA8	10_2_017E4AA8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_017E3E90	10_2_017E3E90
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_017E41D8	10_2_017E41D8
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06640448	10_2_06640448
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06646C54	10_2_06646C54
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06647F83	10_2_06647F83
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06647F88	10_2_06647F88
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06648C77	10_2_06648C77
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06646C48	10_2_06646C48
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_017ECE90	10_2_017ECE90

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2140332453.0000000007F20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2134386068.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2139860310.00000000076C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2136429481.000000000315D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename10920149-2e8b-4d10-98dd-faef01bf06fc.exe4 vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000000.2102695337.0000000000E6A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLoud.exeJ vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2136429481.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename10920149-2e8b-4d10-98dd-faef01bf06fc.exe4 vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4570035103.0000000000D38000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Binary or memory string: OriginalFilenameLoud.exeJ vs 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.skyT.exe.4558350.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.skyT.exe.451d730.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.skyT.exe.3b41b18.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.skyT.exe.3b41b18.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.skyT.exe.4558350.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.skyT.exe.3bb8bd0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.skyT.exe.3bb8bd0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.skyT.exe.451d730.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, I8o55IfytmgWdxmM3Y.cs	Security API names: _0020.SetAccessControl
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, I8o55IfytmgWdxmM3Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, I8o55IfytmgWdxmM3Y.cs	Security API names: _0020.AddAccessRule
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, mjY8HAPE3JTDE1XrJ4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.3143a20.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.3133a14.6.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.349dda4.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.7360000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/9@1/1

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Mutant created: \Sessions\1\BaseNamedObjects\UZnjywb

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdqkews5.pfg.ps1

Jump to behavior

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002D46000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000007.00000002.4573886453.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000007.00000002.4573886453.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 0000000A.00000002.4574644878.0000000003309000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 0000000A.00000002.4574644878.00000000032F5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

File read: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"	Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Section loaded: edputil.dll

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, GameOfLife.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, GameOfLife.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, I8o55IfytmgWdxmM3Y.cs	.Net Code: HNZ2kEsUwE System.Reflection.Assembly.Load(byte[])
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.7f20000.13.raw.unpack, LoginForm.cs	.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.31165f8.3.raw.unpack, LoginForm.cs	.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Code function: 0_2_017CB920 push 18418B05h; ret	0_2_017CBB83
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_026BE16A push ebx; retf	9_2_026BE172
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D122A1 push ebp; retf	9_2_04D122A3
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D163D0 pushfd ; retf	9_2_04D163D6
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D18FA0 pushfd ; retf	9_2_04D18FAE
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D11498 push esi; retf	9_2_04D1179E
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D110C3 push esp; retf	9_2_04D110D2
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D110B3 push esi; retf	9_2_04D110B2
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D110B3 push edi; retf	9_2_04D110C2
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D110A7 push esi; retf	9_2_04D110B2
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D11E97 push esp; retf	9_2_04D11EA6
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_04D11850 push esp; retf	9_2_04D1185E
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CEBECA push esp; retf	9_2_06CEBED6
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE2F88 pushad ; iretd	9_2_06CE2F89
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE8A70 pushad ; iretd	9_2_06CE8A79
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 9_2_06CE8947 push eax; iretd	9_2_06CE8949
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_066422A0 push cs; iretd	10_2_066422AA
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Code function: 10_2_06641913 push es; iretd	10_2_0664191A

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Static PE information: section name: .text entropy: 7.964960726010625

Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, YStk5IOYjMqj0EeRG4.cs	High entropy of concatenated method names: 'y8llyA8diO', 'cuKlUMhg9u', 'jnRlsXm49E', 'ONGshFIwPZ', 'HTdszZ9seA', 'pq7lKcEjWV', 'zjwlNTxCIJ', 'O90lZYF4HG', 'Lxilv0uNZL', 'gSEl2RQsNf'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, mjY8HAPE3JTDE1XrJ4.cs	High entropy of concatenated method names: 'CwnJeie5Vh', 'pQYJHhZWuj', 'rKPJu7y2sN', 'a7MJbSn4TV', 'SfDJX2wmt6', 'ySGJg3Np7C', 'Bj1JB3Bqpy', 'PiDJV7DmWn', 'xhOJ0hxx3g', 'CQUJhNxoCR'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, I8o55IfytmgWdxmM3Y.cs	High entropy of concatenated method names: 'Gjav8yXRGC', 'SEavyyESvT', 'xNMvJImL4Y', 'XOvvU4QPx6', 'DDHvrWlq6o', 'KcCvs0U4om', 'dWqvlRr3hu', 'g3ivfqwuFY', 'He1viogOg5', 'NaVv3d3uHQ'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, sSUVfO93Njxw0miDEa.cs	High entropy of concatenated method names: 'qDhrw7ROkD', 'zVWrYmXT0I', 'yOZUckIxln', 'UpTUp0EyAY', 'vyfULylTm6', 'dNuU7xQJ92', 'Go0UOxbY9L', 'hfTU6w9XWX', 'S5gUSQXvfd', 'FNnUaOW8iT'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, ckDAAq0mjRsFIG5IC4.cs	High entropy of concatenated method names: 'iBRnGa5XFc', 'EBwn5fmbkp', 'N4Znc4Ki5G', 'bpWnp07a2R', 'iuVneruxgT', 'AAKnLwxCnL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, qef9sBImAwUNe94EJd.cs	High entropy of concatenated method names: 'heIqPYwsin', 'V4FqjccVv7', 'yZ5qGPXVTZ', 'zSBq50q9Xw', 'rZEqp6tJ3d', 'gMVqLOd4PL', 'chNqOU9AHH', 'k2Rq6FBom0', 'AnIqa7527c', 'CG4qQuVj62'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, PmKD6VgRIMxp3hCBB0.cs	High entropy of concatenated method names: 'grUtV5OgEQ', 'gytthVNKZT', 'H2lnK47xyc', 'Ay5nNgjpsn', 'KxUtQtXUhT', 'r1ctxOJGHL', 'pT4tIqKbA8', 'xLateO1Ql6', 'j08tHATUQv', 'cdituq5OWn'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, wYWvuM2xsZWf6Kko5I.cs	High entropy of concatenated method names: 'r1RNljY8HA', 's3JNfTDE1X', 'lyrN3qFEvp', 'Ow4NRNFSUV', 'viDNdEaJCh', 'rlXNA2iTj9', 'NqHNhaBvGDcJlpywvy', 'S2QJTPjyandZlgOs0U', 'VhLNNXbr38', 'GsWNvEo9B3'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, KBhn4QhP2O2VFnHvhf.cs	High entropy of concatenated method names: 'llsENjs9Ls', 'YbTEv2RvpX', 'D8hE2ICTq7', 'wt3Ey06JQ7', 'G7sEJw8cU5', 'gXUEroGhe9', 'G4wEs6lbkt', 'wasnB1mTGW', 'lg2nVWZZHZ', 'ULin0MYuHt'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, PyTJP3jyrqFEvpQw4N.cs	High entropy of concatenated method names: 'asPUo4SVpj', 'krsUTqQo7E', 'KIqUP1LfPF', 'ITaUj2QrNf', 'l7nUdJFqYc', 'J89UAkOhB0', 'U5jUtpsvLh', 'TagUnQV396', 'PUZUEw2GIG', 'tGjUFS0NsB'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, fEX4WANvdXcGc1eTU4s.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'njnFer97Jr', 'DqLFHsYJNP', 'GlGFuLWHIL', 'mY2FbaJRQB', 'd9VFXvSr2G', 'VMiFgrDG0F', 'Gj3FB4Xl72'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, nrUakDuYsKXrr3RcGT.cs	High entropy of concatenated method names: 'ToString', 'Ay1AQ3Spsq', 'kcyA5bSECd', 'XcNAcFFY3Z', 'KHIApPZ7p3', 'SNIALOJx0B', 'IHjA78DbDf', 'w0XAOlgllW', 's1bA60fibD', 'HbTASnQaqS'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, QKKt0uZUBaLghvtnCj.cs	High entropy of concatenated method names: 'b70kvT54C', 'CiZob7nA8', 'R13TBIVlf', 'JRLYvuyaI', 'hbfjGIJDu', 'le89xYK6B', 'ADEchtw4raIhp8inyc', 'J8p8vUQZGBMtl2syki', 'rBBn7x4Ip', 'TCXFxVK9m'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, xlbPoNSZIT2A7lpgVn.cs	High entropy of concatenated method names: 'eiZlDEjjTU', 'GKVlMcUlPL', 'MONlktd5X2', 'bpdloA1lth', 'yE0lwJssSf', 'vrZlTkRJXx', 'Aq4lYXO7YR', 'UNglPrrvBu', 'g6hljWy2Q0', 'YSDl9b1g21'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, gChElXG2iTj9pmYkL4.cs	High entropy of concatenated method names: 'owWs8F6uNm', 'DaYsJjUolR', 'CyysrV9f1o', 'R8Ksl90Xsy', 'BfesfrTR3j', 'yeqrXhIbPr', 'NbHrg8xyFS', 'n1HrBKeELh', 'vFZrVfkvw1', 'jOHr0oRCC6'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, idbalSevs0md1CRtV0.cs	High entropy of concatenated method names: 'EVYda1gQlQ', 'ehZdxvEubf', 'XvZdeEuHrW', 'neBdHorEwW', 'AlHd5D7rRk', 'NKxdcHKGpD', 'OLedpyd6sR', 'yUcdLpCifq', 'UNad7SSl8N', 'LradOriPNC'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, eXZIWhV1g8iGIrxMco.cs	High entropy of concatenated method names: 'pLvnyKoxD2', 'ChsnJEwAfE', 'wRUnU24gfA', 'c51nrG2IAI', 'E4unsEIJkp', 'yPMnlR85hX', 'lxdnfLnRE4', 'vhEnidjqWq', 'Wjxn3bUtkn', 'P3knR8wKZW'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, oQXkeEJFwLoP2MaAn3.cs	High entropy of concatenated method names: 'Dispose', 'jFcN0qCPq3', 'IfgZ5ZWbZQ', 'Ggk44gJNKi', 'j8XNhZIWh1', 'U8iNzGIrxM', 'ProcessDialogKey', 'IoZZKkDAAq', 'vjRZNsFIG5', 'QC4ZZ7Bhn4'
Source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44d5ca0.9.raw.unpack, yHAGFTNKKDjK5iO9ZJr.cs	High entropy of concatenated method names: 'uUgED16u5h', 'VtgEMQxdPf', 'pQJEk7rjCD', 'gdPEocDeKA', 'Tf0Ewb2H7K', 'SlCETQ5kEF', 'hTlEY9NTpS', 'f04EPnBWQv', 'KOCEj5W48V', 'cWoE9pccNk'

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

File created: C:\Users\user\AppData\Roaming\skyT\skyT.exe

Jump to dropped file

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run skyT			Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run skyT			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

File opened: C:\Users\user\AppData\Roaming\skyT\skyT.exe:Zone.Identifier read attributes | delete

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1020, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 17A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 50F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 7F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 8F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 90F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: A0F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 2C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory allocated: 4C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 31E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 7A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 8A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 7A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 2E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 4E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 7060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 8060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 82F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 92F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 1690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 3220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory allocated: 3130000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2400000	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399890	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399781	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399670	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399547	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399437	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399327	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399217	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399094	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398969	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398860	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398735	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398610	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398485	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398344	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398234	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398125	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398014	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397891	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397766	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397656	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397547	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397438	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397313	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397188	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397078	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396969	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396844	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396735	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396610	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396496	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396389	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396262	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396156	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396045	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395933	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395813	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395703	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395591	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395469	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395360	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395235	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395110	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394985	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394860	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394749	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394640	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394531	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394422	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399436	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398726	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398625	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397340	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396782	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396532	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396420	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396309	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395979	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395762	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395157	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395032	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394918	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394803	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394686	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2400000
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399887
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399776
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399656
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399545
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399437
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399328
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399218
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399109
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399000
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398890
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398780
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398671
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398561
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398453
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398343
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398234
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398122
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398015
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397906
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397796
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397687
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397578
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397466
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397355
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397234
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397125
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397015
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396906
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396796
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396685
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396578
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396468
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396359
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396250
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396140
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396030
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395921
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395812
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395703
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395593
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395484
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395374
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395265
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395156
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395046
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394937
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394828
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394718
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394609
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394500

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6041	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3278	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Window / User API: threadDelayed 2340	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Window / User API: threadDelayed 7492	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Window / User API: threadDelayed 6900	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Window / User API: threadDelayed 2943	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Window / User API: threadDelayed 2312
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Window / User API: threadDelayed 7541

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 3080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2548	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 2612	Thread sleep count: 2340 > 30	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 2612	Thread sleep count: 7492 > 30	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399670s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2399094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2398014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2397078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396496s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396389s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396262s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2396045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395933s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395591s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2395110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe TID: 1548	Thread sleep time: -2394281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4328	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 3924	Thread sleep count: 6900 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 3924	Thread sleep count: 2943 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399436s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2399110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398726s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2398031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397340s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2397016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396420s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396309s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2396094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395979s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395762s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2395032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394918s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394803s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394686s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 2084	Thread sleep time: -2394124s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 5044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 5156	Thread sleep count: 2312 > 30
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399887s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 5156	Thread sleep count: 7541 > 30
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399776s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399656s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399545s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399437s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399328s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399218s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399109s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2399000s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398890s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398780s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398671s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398561s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398453s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398343s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398234s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398122s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2398015s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397906s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397796s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397687s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397578s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397466s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397355s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397234s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397125s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2397015s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396906s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396796s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396685s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396578s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396468s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396359s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396250s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396140s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2396030s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395921s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395812s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395703s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395593s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395484s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395374s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395265s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395156s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2395046s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2394937s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2394828s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2394718s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2394609s >= -30000s
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe TID: 4600	Thread sleep time: -2394500s >= -30000s

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2400000	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399890	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399781	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399670	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399547	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399437	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399327	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399217	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2399094	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398969	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398860	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398735	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398610	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398485	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398344	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398234	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398125	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2398014	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397891	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397766	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397656	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397547	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397438	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397313	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397188	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2397078	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396969	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396844	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396735	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396610	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396496	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396389	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396262	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396156	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2396045	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395933	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395813	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395703	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395591	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395469	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395360	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395235	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2395110	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394985	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394860	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394749	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394640	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394531	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394422	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Thread delayed: delay time: 2394281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399436	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398726	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398625	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397340	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396782	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396532	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396420	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396309	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395979	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395762	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395282	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395157	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395032	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394918	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394803	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394686	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2400000
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399887
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399776
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399656
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399545
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399437
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399328
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399218
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399109
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2399000
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398890
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398780
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398671
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398561
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398453
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398343
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398234
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398122
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2398015
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397906
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397796
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397687
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397578
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397466
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397355
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397234
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397125
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2397015
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396906
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396796
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396685
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396578
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396468
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396359
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396250
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396140
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2396030
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395921
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395812
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395703
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395593
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395484
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395374
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395265
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395156
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2395046
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394937
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394828
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394718
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394609
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Thread delayed: delay time: 2394500

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4577974413.00000000061A0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Memory written: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory written: C:\Users\user\AppData\Roaming\skyT\skyT.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Memory written: C:\Users\user\AppData\Roaming\skyT\skyT.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Process created: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Process created: C:\Users\user\AppData\Roaming\skyT\skyT.exe "C:\Users\user\AppData\Roaming\skyT\skyT.exe"	Jump to behavior

Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Time: 07/23/2024 16:41:09<br>User Name: user<br>Computer Name: 141700<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br><hr><b>[ Program Manager]</b> (23/05/2024 11:20:44)<br>{Win}r{Win}r
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q3<b>[ Program Manager]</b> (23/05/2024 11:20:44)<br>
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q?<b>[ Program Manager]</b> (23/05/2024 11:20:44)<br>{Win}r{Win}rTH
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q><b>[ Program Manager]</b> (23/05/2024 11:20:44)<br>{Win}r{Win}TH
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q9<b>[ Program Manager]</b> (23/05/2024 11:20:44)<br>{Win}rTH
Source: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q8<b>[ Program Manager]</b> (23/05/2024 11:20:44)<br>{Win}TH

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Users\user\AppData\Roaming\skyT\skyT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Users\user\AppData\Roaming\skyT\skyT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Users\user\AppData\Roaming\skyT\skyT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Users\user\AppData\Roaming\skyT\skyT.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 6.2.skyT.exe.4558350.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.451d730.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3b41b18.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3b41b18.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.4558350.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3bb8bd0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3bb8bd0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.451d730.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1020, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\skyT\skyT.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 6.2.skyT.exe.4558350.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.451d730.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3b41b18.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3b41b18.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.4558350.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3bb8bd0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3bb8bd0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.451d730.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4573886453.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4574644878.000000000322B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1656, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 6.2.skyT.exe.4558350.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.451d730.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3b41b18.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3b41b18.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.4558350.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3bb8bd0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skyT.exe.3bb8bd0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skyT.exe.451d730.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.44682b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.442d690.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe PID: 4232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skyT.exe PID: 1020, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	112 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	21 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	32%	ReversingLabs	Win32.Trojan.Generic
739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	100%	Avira	TR/AD.GenSteal.xzcol
739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\skyT\skyT.exe	100%	Avira	TR/AD.GenSteal.xzcol
C:\Users\user\AppData\Roaming\skyT\skyT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\skyT\skyT.exe	32%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.adgumrukmusavirligi.com	0%	Avira URL Cloud	safe
http://adgumrukmusavirligi.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
adgumrukmusavirligi.com	94.199.206.42	true	true		unknown
mail.adgumrukmusavirligi.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.adgumrukmusavirligi.com	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://adgumrukmusavirligi.com	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000004.00000002.4573708134.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, skyT.exe, 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe, 00000000.00000002.2136429481.000000000315D000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000006.00000002.2294417914.000000000324D000.00000004.00000800.00020000.00000000.sdmp, skyT.exe, 00000009.00000002.2353162012.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.199.206.42	adgumrukmusavirligi.com	Turkey		42807	AEROTEK-ASTR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446056
Start date and time:	2024-05-22 22:00:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/9@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 246 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Simulations

Behavior and APIs

Time	Type	Description
16:01:29	API Interceptor	5224998x Sleep call for process: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe modified
16:01:31	API Interceptor	9x Sleep call for process: powershell.exe modified
16:01:43	API Interceptor	8288603x Sleep call for process: skyT.exe modified
22:01:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run skyT C:\Users\user\AppData\Roaming\skyT\skyT.exe
22:01:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run skyT C:\Users\user\AppData\Roaming\skyT\skyT.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.199.206.42	024 - PT MARGATEK_ SETYATAMA PO 13100976 _20.05.2024 %100%_jpg .exe	Get hash	malicious	AgentTesla	Browse
	#U0130#U015eLEM #U00d6ZET#U0130_20524057699-1034 nolu TICARI.exe	Get hash	malicious	AgentTesla	Browse
	Siparis. #PO000867000960 AZTEK Order _ BIRLESIM NEKS A.s 14.05.2024 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	x7VYkFQt3J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	a2hghg40qH.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Siparis. 000867000960 AZTEK Order _ TEKNIKSAT A.s 08.05.2024 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	OsGKwfqamz.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Fiyat teklifi. SERYAPIM #U0130N#U015e. 2023 YILI M#U0130ZAN.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Fiyat teklifi. YILMAZ #U0130N#U015e A,s. 07052024 YILI M#U0130ZAN Sip PO-00901 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	YILMAZ - Turkey siparis_Fiyat teklif 0058118592 - VANTUZ.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AEROTEK-ASTR	024 - PT MARGATEK_ SETYATAMA PO 13100976 _20.05.2024 %100%_jpg .exe	Get hash	malicious	AgentTesla	Browse	94.199.206.42
	oae7jKW2lr.exe	Get hash	malicious	AgentTesla	Browse	109.232.216.54
	#U0130#U015eLEM #U00d6ZET#U0130_20524057699-1034 nolu TICARI.exe	Get hash	malicious	AgentTesla	Browse	94.199.206.42
	F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	109.232.216.54
	F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130.exe	Get hash	malicious	AgentTesla	Browse	109.232.216.54
	F#U0130YAT TALEB#U0130.exe	Get hash	malicious	AgentTesla	Browse	109.232.216.54
	Siparis. #PO000867000960 AZTEK Order _ BIRLESIM NEKS A.s 14.05.2024 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	94.199.206.42
	F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	109.232.216.54
	x7VYkFQt3J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	94.199.206.42
	a2hghg40qH.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	94.199.206.42

Process:	C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\skyT.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\skyT\skyT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.357042452875322
Encrypted:	false
SSDEEP:	24:3CytZWSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NKIl9r+q:yyjWSU4xymI4RfoUeW+mZ9tK8ND3
MD5:	827C68C8F65D2B0800E6791B34AB6D2E
SHA1:	151BC96F9C26C53E02D2E0DA64995A462D0C3B4E
SHA-256:	6B22A727792EC2ACE1BC27BF00BECBBD842902F2FD0FC813CF45A21A986377D5
SHA-512:	67E9E89C531B2CDF47FCBBA3F036EA66427631A8EBF287A26DD35AFB114AF6E2D945304CBF72B94358245FEED658F9BA6E19B29879AE6488D8DC7A143DCC146D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdqkews5.pfg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lusoxbnx.xvu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sxmetalv.zzq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y4dq2nki.fh1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\skyT\skyT.exe

Download File

Process:	C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	686080
Entropy (8bit):	7.956438273738751
Encrypted:	false
SSDEEP:	12288:yfz4TLzf3S3WNDTOlZhMAKA/9hdW3GTTdxfCu5SY3+Uln+MymlyblNQbf:2z4TLzf3OWZiVMAz/9PWmTuuY/zmlyhS
MD5:	784BA798F9AA395A8ED0CD2D1E557320
SHA1:	D368D6B2507F3523702B855A19F0B6EB8380320B
SHA-256:	3979EB243225878A1331722D77EEB7D5937691A9E81322BFE24F5AE23AA855F6
SHA-512:	9C806128DA404126FCCDCE4E26E087D4121C80CDC7E23D29B5FE1DFA068A9E1DCAD91D7F36C6C62885BA676D88E63C39906BF7BABC4CE15994A4891770BA208B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.Mf.................d............... ........@.. ....................................@.................................`...K.................................................................................... ............... ..H............text....c... ...d.................. ..`.rsrc................f..............@..@.reloc...............v..............@..B........................H........<...F......U....................................................0..A....... .........%.C...(.....D... .........%.I...(.....J...(.........&.....s....}.....s....}.....s....}.....r...p}....+..(.....(....*.0..........~D.....~J..........E....s...Q.......5...s.......Q...s......r...po.....r...po.....rq..po........ <~..Y..+..r...po.....o.....@.......+..o......o......{.....o.......8j....o....(........(....+......E........................+..s......+.+......E............k...B

C:\Users\user\AppData\Roaming\skyT\skyT.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.956438273738751
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
File size:	686'080 bytes
MD5:	784ba798f9aa395a8ed0cd2d1e557320
SHA1:	d368d6b2507f3523702b855a19f0b6eb8380320b
SHA256:	3979eb243225878a1331722d77eeb7d5937691a9e81322bfe24f5ae23aa855f6
SHA512:	9c806128da404126fccdce4e26e087d4121c80cdc7e23d29b5fe1dfa068a9e1dcad91d7f36c6c62885ba676d88e63c39906bf7babc4ce15994a4891770ba208b
SSDEEP:	12288:yfz4TLzf3S3WNDTOlZhMAKA/9hdW3GTTdxfCu5SY3+Uln+MymlyblNQbf:2z4TLzf3OWZiVMAz/9PWmTuuY/zmlyhS
TLSH:	39E4230CBBB569D3C46E83F7E579811647B492903A47D2CD9EDA78924EA7F0841C3F0A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.Mf.................d............... ........@.. ....................................@................................

File Icon


Icon Hash:	c04e363636261032

Static PE Info

General

Entrypoint:	0x4a83ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x664DB441 [Wed May 22 09:00:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa8360	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x1000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa63b4	0xa6400	7888ff0d39e68f5867e78035596f827a	False	0.9693300634398496	data	7.964960726010625	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x1000	0x1000	fb1b9bb7c4b14cc80126d54162f0ead0	False	0.64794921875	data	5.904582185307584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	9ca65768d02e50b08a273ee2bb7ad986	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaa100	0x7f0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9281496062992126
RT_GROUP_ICON	0xaa900	0x14	data	1.05
RT_VERSION	0xaa924	0x344	data	0.43301435406698563
RT_MANIFEST	0xaac78	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/22/24-22:03:11.679391	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	60101	587	192.168.2.6	94.199.206.42
05/22/24-22:03:11.679391	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	60101	587	192.168.2.6	94.199.206.42

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 22:03:07.303745985 CEST	60100	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:07.308881998 CEST	587	60100	94.199.206.42	192.168.2.6
May 22, 2024 22:03:07.309473991 CEST	60100	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:08.017620087 CEST	60100	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:08.023134947 CEST	587	60100	94.199.206.42	192.168.2.6
May 22, 2024 22:03:08.039237976 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:08.044187069 CEST	587	60100	94.199.206.42	192.168.2.6
May 22, 2024 22:03:08.044246912 CEST	60100	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:08.049159050 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:08.049232960 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:09.116610050 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:09.118518114 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:09.128329039 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:09.343836069 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:09.392146111 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:10.318700075 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:10.323971987 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:10.539211988 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:10.540031910 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:10.544924021 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:10.762968063 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:10.763569117 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:10.768475056 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:10.983319044 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:10.983717918 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:10.988784075 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.456026077 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.456681967 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:11.462352037 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.678024054 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.679390907 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:11.679390907 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:11.679390907 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:11.679390907 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:03:11.684441090 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.689301968 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.735330105 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:11.735344887 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:12.069333076 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:03:12.144575119 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:04:48.161341906 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:04:48.166588068 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:04:48.585601091 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:04:48.585730076 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:04:48.590565920 CEST	587	60101	94.199.206.42	192.168.2.6
May 22, 2024 22:04:48.590673923 CEST	60101	587	192.168.2.6	94.199.206.42
May 22, 2024 22:04:48.595614910 CEST	587	60101	94.199.206.42	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 22:01:48.448775053 CEST	53	51526	1.1.1.1	192.168.2.6
May 22, 2024 22:01:49.931037903 CEST	53	59309	1.1.1.1	192.168.2.6
May 22, 2024 22:03:06.961353064 CEST	49387	53	192.168.2.6	1.1.1.1
May 22, 2024 22:03:07.291306973 CEST	53	49387	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 22:03:06.961353064 CEST	192.168.2.6	1.1.1.1	0x35ec	Standard query (0)	mail.adgumrukmusavirligi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 22, 2024 22:03:07.291306973 CEST	1.1.1.1	192.168.2.6	0x35ec	No error (0)	mail.adgumrukmusavirligi.com	adgumrukmusavirligi.com		CNAME (Canonical name)	IN (0x0001)	false
May 22, 2024 22:03:07.291306973 CEST	1.1.1.1	192.168.2.6	0x35ec	No error (0)	adgumrukmusavirligi.com		94.199.206.42	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 22, 2024 22:03:09.116610050 CEST	587	60101	94.199.206.42	192.168.2.6	220-srvc41.turhost.com ESMTP Exim 4.97.1 #2 Wed, 22 May 2024 23:03:07 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 22, 2024 22:03:09.118518114 CEST	60101	587	192.168.2.6	94.199.206.42	EHLO 141700
May 22, 2024 22:03:09.343836069 CEST	587	60101	94.199.206.42	192.168.2.6	250-srvc41.turhost.com Hello 141700 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 22, 2024 22:03:10.318700075 CEST	60101	587	192.168.2.6	94.199.206.42	AUTH login Z2l6ZW1jZXZpa0BhZGd1bXJ1a211c2F2aXJsaWdpLmNvbQ==
May 22, 2024 22:03:10.539211988 CEST	587	60101	94.199.206.42	192.168.2.6	334 UGFzc3dvcmQ6
May 22, 2024 22:03:10.762968063 CEST	587	60101	94.199.206.42	192.168.2.6	235 Authentication succeeded
May 22, 2024 22:03:10.763569117 CEST	60101	587	192.168.2.6	94.199.206.42	MAIL FROM:<gizemcevik@adgumrukmusavirligi.com>
May 22, 2024 22:03:10.983319044 CEST	587	60101	94.199.206.42	192.168.2.6	250 OK
May 22, 2024 22:03:10.983717918 CEST	60101	587	192.168.2.6	94.199.206.42	RCPT TO:<obikachikezienelson19@gmail.com>
May 22, 2024 22:03:11.456026077 CEST	587	60101	94.199.206.42	192.168.2.6	250 Accepted
May 22, 2024 22:03:11.456681967 CEST	60101	587	192.168.2.6	94.199.206.42	DATA
May 22, 2024 22:03:11.678024054 CEST	587	60101	94.199.206.42	192.168.2.6	354 Enter message, ending with "." on a line by itself
May 22, 2024 22:03:11.679390907 CEST	60101	587	192.168.2.6	94.199.206.42	.
May 22, 2024 22:03:12.069333076 CEST	587	60101	94.199.206.42	192.168.2.6	250 OK id=1s9sB4-00000003a0Q-2I1w
May 22, 2024 22:04:48.161341906 CEST	60101	587	192.168.2.6	94.199.206.42	QUIT
May 22, 2024 22:04:48.585601091 CEST	587	60101	94.199.206.42	192.168.2.6	221 srvc41.turhost.com closing connection

Target ID:	0
Start time:	16:01:29
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Imagebase:	0xdc0000
File size:	686'080 bytes
MD5 hash:	784BA798F9AA395A8ED0CD2D1E557320
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2137030214.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2137030214.000000000442D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:01:30
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Imagebase:	0xc00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:01:30
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe"
Imagebase:	0x8e0000
File size:	686'080 bytes
MD5 hash:	784BA798F9AA395A8ED0CD2D1E557320
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4573708134.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	16:01:30
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:01:43
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Roaming\skyT\skyT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Imagebase:	0xd90000
File size:	686'080 bytes
MD5 hash:	784BA798F9AA395A8ED0CD2D1E557320
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2295766136.000000000451D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:01:45
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Roaming\skyT\skyT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Imagebase:	0xab0000
File size:	686'080 bytes
MD5 hash:	784BA798F9AA395A8ED0CD2D1E557320
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.4569543128.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.4573886453.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:01:51
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Roaming\skyT\skyT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Imagebase:	0x3e0000
File size:	686'080 bytes
MD5 hash:	784BA798F9AA395A8ED0CD2D1E557320
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2357943673.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2357943673.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:01:51
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Roaming\skyT\skyT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\skyT\skyT.exe"
Imagebase:	0xd70000
File size:	686'080 bytes
MD5 hash:	784BA798F9AA395A8ED0CD2D1E557320
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.4574644878.000000000322B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	218
Total number of Limit Nodes:	14

Executed Functions

Function 073CB392 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428ac68a8a4576ccac86cf5b0cc9589a3139813ece01c739d7ffbc2ec192711e
Instruction ID: 2392e5058ce5b666fa03610d09da7b1b853c388d626dc04117a1c0ebb4a17a7e
Opcode Fuzzy Hash: 428ac68a8a4576ccac86cf5b0cc9589a3139813ece01c739d7ffbc2ec192711e
Instruction Fuzzy Hash: F751DAF1D157198BEB24CF66C8453DAFBBAAFC9300F14D1AAC40DA6611EB741A85CF40

Function 017CD490 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017CD51E
GetCurrentThread.KERNEL32 ref: 017CD55B
GetCurrentProcess.KERNEL32 ref: 017CD598
GetCurrentThreadId.KERNEL32 ref: 017CD5F1

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 92b6ab85b30fa753ab745f6974ed482da1ed5b52d12c34f0b91ae4835c3c5587
Instruction ID: 3b8d22a868c058338a2fee79fcc7f4e2750941bb9783ff6f28deb829a61ebf75
Opcode Fuzzy Hash: 92b6ab85b30fa753ab745f6974ed482da1ed5b52d12c34f0b91ae4835c3c5587
Instruction Fuzzy Hash: 595155B09003099FDB14CFA9D948BAEFBF1AF88314F20846DE519A7390DB74A944CF65

Function 017CD4A0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017CD51E
GetCurrentThread.KERNEL32 ref: 017CD55B
GetCurrentProcess.KERNEL32 ref: 017CD598
GetCurrentThreadId.KERNEL32 ref: 017CD5F1

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7f636a313721e10866fa0e570640121598b43762950001e382d8d71dbeca7108
Instruction ID: df29ab5b49c374b68e1f586baf80df3e5af88efe070c602e5c41d044c66e81d9
Opcode Fuzzy Hash: 7f636a313721e10866fa0e570640121598b43762950001e382d8d71dbeca7108
Instruction Fuzzy Hash: 9F5164B09003098FDB14CFA9D548BAEFFF1AF88314F20846DE419A7250DB74A944CB65

Function 073C93ED Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073C962E

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d981d3d80c158aa5efb8328da476892621481a2758a9a1830eb2f9403d68982d
Instruction ID: a65e46a40b9415f225426377da420ae5efd16aa75774f82e5eca82d8313fc681
Opcode Fuzzy Hash: d981d3d80c158aa5efb8328da476892621481a2758a9a1830eb2f9403d68982d
Instruction Fuzzy Hash: 72A15DB1D0021ADFEF24CF68C8417DDBBB2BF48314F1585A9E909A7280DB759985CF91

Function 073C93F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073C962E

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1b0e236a6499eb6f5187f162189c66ce60872d7f96b09be600f6097146b3abf8
Instruction ID: f3f196cbaf816f791a9437cb1f4110649358b34e09cd887cfadb3c97609a2362
Opcode Fuzzy Hash: 1b0e236a6499eb6f5187f162189c66ce60872d7f96b09be600f6097146b3abf8
Instruction Fuzzy Hash: F9915DB1D0021ADFEF14CF68C8417DDBBB2BF48314F1585A9E908A7280DB759985CF91

Function 017CB208 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017CB45E

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fa6deb0836ad64e752d01d999e3090f9cfb1591d5ea6386644d0c32f7c03dde1
Instruction ID: 3588156c6a924d593138a31b993850ddd0b2f432fbcdaf988070b94c40c08fe8
Opcode Fuzzy Hash: fa6deb0836ad64e752d01d999e3090f9cfb1591d5ea6386644d0c32f7c03dde1
Instruction Fuzzy Hash: 58711270A00B098FD724DF6AD44575AFBF2FF88744F008A2DE58A97A40DB74E805CB91

Function 017C4874 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017C5DD9

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e45f3c903d8da183e45a70dd39e790ef183cb61f7a35e9dd5910d1b83c48b5cd
Instruction ID: d957cb35bbc6aec5303c2875e642f4c37dd62b8c58d900639476a673203d912b
Opcode Fuzzy Hash: e45f3c903d8da183e45a70dd39e790ef183cb61f7a35e9dd5910d1b83c48b5cd
Instruction Fuzzy Hash: 1341EFB0D0071DCBDB24DFA9C984B9EFBB5BF48704F60816AD408AB251DB756946CF90

Function 017C5D1C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017C5DD9

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5a8d3d5d9a24b157b094677dfd022729562e2c3cc7ae3d6a962fe0e970aa1164
Instruction ID: 7132068dff6af888ef6af0f5c4bc82c6dfff04095dbcaa44b904348a8687b06f
Opcode Fuzzy Hash: 5a8d3d5d9a24b157b094677dfd022729562e2c3cc7ae3d6a962fe0e970aa1164
Instruction Fuzzy Hash: 7B41FFB0C0071DCBEB24DFA9C884B9EFBB5BF48704F20816AD408AB251DB756946CF50

Function 073C8D68 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073C8E00

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5e5fb327c477eb99c432b4d48890c1776c4af995d47bd73716bfb71240b72d9c
Instruction ID: 83ca93e69ee813dfb2d2eeceffaf274e126b6165ed4bc882351d4022302e48f0
Opcode Fuzzy Hash: 5e5fb327c477eb99c432b4d48890c1776c4af995d47bd73716bfb71240b72d9c
Instruction Fuzzy Hash: 1B2117B5900349DFDB10CFA9C885BDEBBF5BF48314F10882AE519A7241C7789950CBA5

Function 073C8D70 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073C8E00

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c4f69a0d28026c7041cdc8d70497982e40c5f4763730c6a6cc24e4443ae87974
Instruction ID: d29b8b7b025519661e8c487bcd790e493c39fe029cbb62288935d3ee4324a9e3
Opcode Fuzzy Hash: c4f69a0d28026c7041cdc8d70497982e40c5f4763730c6a6cc24e4443ae87974
Instruction Fuzzy Hash: C62126B590034ADFDB10CFA9C885BDEBBF5FF48310F108429E918A7240C7789950CBA4

Function 073C8E58 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073C8EE0

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8da26528d21ad363f4575696e3325eab14e49f80852fd2028c80e2ca88fa287c
Instruction ID: 0c85f220d7bf9120f7d8389b37cb6705b0fc01ca295f1cb23b9f0f9add03f4d8
Opcode Fuzzy Hash: 8da26528d21ad363f4575696e3325eab14e49f80852fd2028c80e2ca88fa287c
Instruction Fuzzy Hash: 552119B18003499FDB10CFAAC885ADEBBF5FF48324F10842AE518A7250C7799950CBA5

Function 073C8BD1 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073C8C56

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 36d6b365683f6e4cef4a99eaa3f9215efb55e8cf3e1f235eab4c2c0f5d755547
Instruction ID: 77f4c3c2d1f34c20aa3944ab943f1e1b0249c5c5c6995127b81ee08e409e8fcc
Opcode Fuzzy Hash: 36d6b365683f6e4cef4a99eaa3f9215efb55e8cf3e1f235eab4c2c0f5d755547
Instruction Fuzzy Hash: DF2137B19003099FEB10DFAAC4857EEFBF4AF88224F14842AD559A7240CB789945CFA5

Function 017CD6E1 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017CD76F

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8c1684ddbf6f6a08e79862f996d765f72bb06025467adc9f2f543239209ed71f
Instruction ID: d6f6830195148a76c7f120b826307ca18c4e4d3d41e438251f5212a100e83c5a
Opcode Fuzzy Hash: 8c1684ddbf6f6a08e79862f996d765f72bb06025467adc9f2f543239209ed71f
Instruction Fuzzy Hash: 6B21E3B5900249EFDB10CF9AD984ADEFBF4FB48724F24842AE914A3250D374A950CFA0

Function 073C8E60 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073C8EE0

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7e8b11ca21602a6d46ca6b7bbf471b0c91542e0f79f193d0455f02750b046010
Instruction ID: daa080403db1cf90131d9dd8873effd1b4547e25329534c97a518cd524cac16f
Opcode Fuzzy Hash: 7e8b11ca21602a6d46ca6b7bbf471b0c91542e0f79f193d0455f02750b046010
Instruction Fuzzy Hash: 7421E6B19003599FDB10DFAAC881ADEBBF5FF48310F108429E519A7250D7799950CBA5

Function 073C8BD8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073C8C56

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: deb318d020de25807c0452319471ae103523d2cdc844354b51eee9e4bb0d4772
Instruction ID: ef9ad04a73305c934fe59667c9ca8ad3908342d813a9a70df9a439d131edfedf
Opcode Fuzzy Hash: deb318d020de25807c0452319471ae103523d2cdc844354b51eee9e4bb0d4772
Instruction Fuzzy Hash: 772107B19003099FEB10DFAAC4857EEBBF4AF88224F148429D559A7240DB789945CFA5

Function 017CD6E8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017CD76F

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c4528b7a54428cceae1ebef0ac11546ea4a7bbc19d79eafdb4aaad2cf195e11f
Instruction ID: 8713dd333810df7182521ccb96168192eb6492afa5e34a01c65b0849d3440a8a
Opcode Fuzzy Hash: c4528b7a54428cceae1ebef0ac11546ea4a7bbc19d79eafdb4aaad2cf195e11f
Instruction Fuzzy Hash: 1521E3B59002499FDB10CF9AD984ADEFBF4FB48320F14841AE914A3210D374A950CFA0

Function 073C8CA8 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073C8D1E

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 704368cb55f5e1164452d4c525a23b96be72e92d58434ab0509cbe9f5f89d75c
Instruction ID: 331e03fc44f2976a05c93aba653d1cfe01fa586ef996859f30b396ca6640f335
Opcode Fuzzy Hash: 704368cb55f5e1164452d4c525a23b96be72e92d58434ab0509cbe9f5f89d75c
Instruction Fuzzy Hash: D9115C768002499FDF10CFA9C845BDFBBF5EF48324F108819E519A7250C775A950CFA1

Function 017CAC10 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017CB4D9,00000800,00000000,00000000), ref: 017CB6EA

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 78b4325abe97ff070e01e2ad5410c2c06ef5821469ff8c75edc7188bce235613
Instruction ID: 203b3a33d1c0ef49761ec545b3766dfe1b3c4fe79b6147c41d1ee3de078972b7
Opcode Fuzzy Hash: 78b4325abe97ff070e01e2ad5410c2c06ef5821469ff8c75edc7188bce235613
Instruction Fuzzy Hash: E31103B68042499FDB10CF9AD844A9EFBF8AB48720F10846EE919A7200C3B5A544CFA4

Function 017CB679 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017CB4D9,00000800,00000000,00000000), ref: 017CB6EA

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 50cf9591644b5f1fbd077585a2c5822bb5f77ac95d9857310f5d3c658454fffc
Instruction ID: e6474cd0709cd967dede75324ba44020cff662abff354fb738808a37d55cb0b6
Opcode Fuzzy Hash: 50cf9591644b5f1fbd077585a2c5822bb5f77ac95d9857310f5d3c658454fffc
Instruction Fuzzy Hash: 061112B68003498FDB10CF9AD885B9EFBF8EB88724F14842EE519B7200C375A545CFA4

Function 073C8CB0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073C8D1E

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2a92a39aedcbd07c0c22b304a6f9e6c360e6b048a6f8bb518ab06a614186b24
Instruction ID: 8df0d7a55ad232f23d8f9a3d9f347432b1a65cd008b69d53c0999acc3e8f5036
Opcode Fuzzy Hash: f2a92a39aedcbd07c0c22b304a6f9e6c360e6b048a6f8bb518ab06a614186b24
Instruction Fuzzy Hash: 721156728002499FDB10CFAAC845BDFBBF5AF88320F208819E519A7250C775A910CFA0

Function 073C8B20 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073C8B8A

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 783e2e3b8f589f1e5e418a8ccb26f082ed826bcf96799e29702b5c8bc2e89eb3
Instruction ID: 19cfeb6aee3cc7c85832c46c2cf7b12ddbdc911a1d127863cd414ada7517f0ef
Opcode Fuzzy Hash: 783e2e3b8f589f1e5e418a8ccb26f082ed826bcf96799e29702b5c8bc2e89eb3
Instruction Fuzzy Hash: 02115BB19003498FDB20DFAAC4457DEFBF4AF88324F24841AD519A7240CB75A940CF95

Function 073C8B28 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073C8B8A

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d5d6b7327246141c0fc952a1de44d76eaa732cf68a6c7ae9b30d880ad84c7af7
Instruction ID: f812709e1253630802ec07cc3d297c664fefb644902e21d8fb753b54e6fc06d6
Opcode Fuzzy Hash: d5d6b7327246141c0fc952a1de44d76eaa732cf68a6c7ae9b30d880ad84c7af7
Instruction Fuzzy Hash: 32113AB1900349CFDB10DFAAC4457DEFBF4AF88724F248419D519A7240CB75A940CF95

Function 017CB3F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017CB45E

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c7443e5af5c994ae9f9cc62ec9561747f26d2c306f536fcf0c6fcb6146996eb2
Instruction ID: d074024fe4918c1492afbc69e707216e2fdf95736510f091a70bc63c98a0da1f
Opcode Fuzzy Hash: c7443e5af5c994ae9f9cc62ec9561747f26d2c306f536fcf0c6fcb6146996eb2
Instruction Fuzzy Hash: 4511DFB6C046498FDB10CF9AC445A9EFBF8AB88724F10846ED529A7210D379A645CFA1

Function 073CC488 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 073CC4ED

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1100d2ecd84df21d3fba65d63e24eab2635a5bf5d1b61a9b692c3313cf62d9de
Instruction ID: 46a523886b5d2a7c00e6b1d6d2a68a8bdb71a9ac4e8148d8c8cc9801b81dc58f
Opcode Fuzzy Hash: 1100d2ecd84df21d3fba65d63e24eab2635a5bf5d1b61a9b692c3313cf62d9de
Instruction Fuzzy Hash: 191122B58003499FDB20CF9AC885BDEFBF8EB48320F208449E518A7200D375A944CFA1

Function 073C90C4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 073CC4ED

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a2c40a6fc277edf476c8b5a8f294b4265770fc4a96f9a183800bcf60780182b3
Instruction ID: 7bb235721776f7c3458c38e7dfe59a3e57bc2b1d508735a5c4622a924f9d8119
Opcode Fuzzy Hash: a2c40a6fc277edf476c8b5a8f294b4265770fc4a96f9a183800bcf60780182b3
Instruction Fuzzy Hash: 1011F2B5800359DFDB10DF9AC485BEEFBF8EB48324F208459E518A7210D3B5A944CFA5

Function 017CB721 Relevance: 1.5, APIs: 1, Instructions: 44libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017CB4D9,00000800,00000000,00000000), ref: 017CB6EA

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9360f9406402357694aa03eea2480cd4d6f957577aba847d4e5d90b066d842dd
Instruction ID: 55f93f59c9f17ce22f94d8cca2aaa050ff8def17b7abd47615f5dfeb41592e04
Opcode Fuzzy Hash: 9360f9406402357694aa03eea2480cd4d6f957577aba847d4e5d90b066d842dd
Instruction Fuzzy Hash: 9201A2B29003099FDB109B9DD8097DAFBE8EF94764F04802EE609E3250C7B99450CB65

Function 0174D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135762446.000000000174D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0174D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0b99f667ea8e991303b14289119b2b53cd9108522b337455fa715d3c3bcd14
Instruction ID: da0bf47ffa911e01c7947fccdef67a0396d012f8aab1071403e769a05aff8d12
Opcode Fuzzy Hash: 7f0b99f667ea8e991303b14289119b2b53cd9108522b337455fa715d3c3bcd14
Instruction Fuzzy Hash: 63212275604204EFDB25DF94D9C4B26FB61FB98314F20C5ADD98A0B262C37AD407CA61

Function 0174D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135762446.000000000174D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0174D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 7d3c335310694a2994bf4feadc6bb415bc54cd4276fda4435175ed2a68db4224
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 3F11DD75504284CFCB26CF54D5C4B15FFA2FB88314F24C6AED8494B666C33AD40ACBA2

Function 0173D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135688890.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_173d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4af4b3bbe61ca436342e2a1b4538a531338d7b0ce6652fbf2a2d9c0d7e2cdd7
Instruction ID: 7a20bb10fc780a8c4e19fa392aa94b22f4998087d56e64fce9238c055ca94914
Opcode Fuzzy Hash: d4af4b3bbe61ca436342e2a1b4538a531338d7b0ce6652fbf2a2d9c0d7e2cdd7
Instruction Fuzzy Hash: D7012671004380DAF7324BA9CD84B66FFD8EFC1324F58C45AEE080A287C7B89840CAB1

Function 0173D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135688890.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_173d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4035b9c9fd7c1247a4276948c8d66805e3acc62c213a83c62c6dc7b0cf7cedf6
Instruction ID: b636c8ab716812c556b1fed437a33c56ddb4d69d2defb02f6b9aeb856629d6af
Opcode Fuzzy Hash: 4035b9c9fd7c1247a4276948c8d66805e3acc62c213a83c62c6dc7b0cf7cedf6
Instruction Fuzzy Hash: 16F062714053849EE7218A5ADD84B62FFA8EF91734F18C45AED485B287C379A844CAB1

Non-executed Functions

Function 073CE120 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

}Y<, xrefs: 073CE574

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID: }Y<
API String ID: 0-4108299924
Opcode ID: fb4cf2429cc2c9ea9d46c80a9e63ed4f169b740973568ae796859a0454645eb5
Instruction ID: 2dba8dacfb8f2c27807ff7b63439b0311ee2f897638c1f7a46092e7d2bdb5df9
Opcode Fuzzy Hash: fb4cf2429cc2c9ea9d46c80a9e63ed4f169b740973568ae796859a0454645eb5
Instruction Fuzzy Hash: CBF1BCB0B412198FEB15DBB5C454BAEB7F6AF89700F14846DD109EB294DB34DE01CB51

Function 073C8300 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dfddbddedb1bbe8057b5383c72a162bf19615074928cfd27766c0086255ca4a
Instruction ID: 4e25cd5e292a8a7e8ddc148bd221c44e57af17585cc899bd8531cb7488543272
Opcode Fuzzy Hash: 6dfddbddedb1bbe8057b5383c72a162bf19615074928cfd27766c0086255ca4a
Instruction Fuzzy Hash: B5E10AB4E002598FDB14DFA9C580AAEFBB2FF89304F248169D518AB355D734AD42CF61

Function 073C63E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d7803626962e498c40eee6f681ac96e9c7882e3c1468e7b00bac41d29b1f4f
Instruction ID: cc58a476c09ac384c266bc223437e1391cb77de15c184c7c12c7dfaa1627f65a
Opcode Fuzzy Hash: e6d7803626962e498c40eee6f681ac96e9c7882e3c1468e7b00bac41d29b1f4f
Instruction Fuzzy Hash: 5CE1F9B4E00259CFDB14DFA9C581AAEBBB2FF89304F248169D418AB355D734AD42CF61

Function 073C5FB0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba23b521b30691e37b4e401c92a909fd63715c020ce1fb2941798640b91005a5
Instruction ID: aa8dceadd22a6e5f808812c721fdd9dfb624d70abd979d34bd8151818ca8a377
Opcode Fuzzy Hash: ba23b521b30691e37b4e401c92a909fd63715c020ce1fb2941798640b91005a5
Instruction Fuzzy Hash: F9E10AB4E00259CFDB14DFA9C581AAEBBB2FF89304F248269D408A7355D735AD42CF61

Function 073C7EC8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2007e244e5e29621b2e8572873ee42aa99ef11e4ed75a86a58bc248ce5db52
Instruction ID: ed673791dfad554fac33db00853afe854c668cc43562c6be768997ca0a2e1d30
Opcode Fuzzy Hash: 7d2007e244e5e29621b2e8572873ee42aa99ef11e4ed75a86a58bc248ce5db52
Instruction Fuzzy Hash: 16E1E9B4E002598FDB14DFA9C580AAEBBF2FF89304F248269D418A7355D734AD42CF61

Function 073C7A90 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc061444bd9af6dd4a85eadbf03dce42bd5cad63b9cb7144924b73f7243e7dd
Instruction ID: 75c932aef2b9833e4c3d1de812a326a7f3701819a401b07de265d7b81d3b1063
Opcode Fuzzy Hash: dfc061444bd9af6dd4a85eadbf03dce42bd5cad63b9cb7144924b73f7243e7dd
Instruction Fuzzy Hash: 2EE1EBB4E102598FDB14DFA9C580AAEFBB2FF89304F248169D818A7355D734AD42CF61

Function 017CE02C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136163227.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2166bed92ac3171405fbae13fe5f534cf50fff8547546949945d217fca8b462d
Instruction ID: 12a73bda2fabcc70de45133803f45278ea7dfd94c3ab9682384b46ae11e6a8c4
Opcode Fuzzy Hash: 2166bed92ac3171405fbae13fe5f534cf50fff8547546949945d217fca8b462d
Instruction Fuzzy Hash: A5A14B32E0021A8FCF05DFB4C84459EFBB2FF84700B25856EE905AB265DB75E956CB90

Function 073C82F0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87da25a6a81f8eb45ebddc785c8407aead4fd7c6ca013dcd4d9ff8bf4fca8a9d
Instruction ID: 3c4e35a6bfc502b9f9eecc097e9f6d48bd0fa9f68f4a72868291d2838b98ac13
Opcode Fuzzy Hash: 87da25a6a81f8eb45ebddc785c8407aead4fd7c6ca013dcd4d9ff8bf4fca8a9d
Instruction Fuzzy Hash: 965109B4E102698FDB14CFA9C5805AEFBF6FF89304F248169D418AB215D7359E42CFA1

Function 073C7EB8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8561d20d549df00e803bc4eca0c2d3f8dc54d95033f7033ce5ae0355e29e6b
Instruction ID: c003eaf8d9203f6a0113a9e2ba8a805e5e5eb08c2c0500e513f1a0d91d096ec6
Opcode Fuzzy Hash: 3b8561d20d549df00e803bc4eca0c2d3f8dc54d95033f7033ce5ae0355e29e6b
Instruction Fuzzy Hash: 9B511AB4E002198BDB14DFA9C5805AEFBF6BF89304F248269D818A7355D7359E42CFA1

Function 073C7A80 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adfbb6176e7439b585fde1e4b5115be7d5ae83c619b41642c5df2fcd7341b8cb
Instruction ID: c928e1966fcfcb695bd19c50fa872d78b7b72d724d2d2cbf18ec09bfbaf8aa09
Opcode Fuzzy Hash: adfbb6176e7439b585fde1e4b5115be7d5ae83c619b41642c5df2fcd7341b8cb
Instruction Fuzzy Hash: 0D5109B5E1021A8FDB14CFA9C5805AEBBF2FF89304F248169D818A7315D7359D42CF61

Function 073CBC83 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139734407.00000000073C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73c0000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc7601b0601320b98e8f388b027e0d4cd298b4f79a227fdbb25685ac76772b3
Instruction ID: f5f54da1f3c33d1496992403585678e11b33c0002c4a97f3599f966f4db07f9a
Opcode Fuzzy Hash: 6cc7601b0601320b98e8f388b027e0d4cd298b4f79a227fdbb25685ac76772b3
Instruction Fuzzy Hash: 50B092E6EEA108D1A9008E8474024F8E33CC28B022E00306AD60EA3E1142118E2A4B58

Analysis Process: 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exePID: 3160, Parent PID: 4232COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	93.4%
Signature Coverage:	0%
Total number of Nodes:	182
Total number of Limit Nodes:	16

Executed Functions

Function 062CC601 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 062CC68E
GetCurrentThread.KERNEL32 ref: 062CC6CB
GetCurrentProcess.KERNEL32 ref: 062CC708
GetCurrentThreadId.KERNEL32 ref: 062CC761

Strings

`K, xrefs: 062CC78D

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: Current$ProcessThread
String ID: `K
API String ID: 2063062207-1731638711
Opcode ID: 59a2d94db6ceabe75d488c1a27127b15107d824c2035617c1d08ac92aeb7720d
Instruction ID: ab854464ace52aa22469c7375b85c3254039177555a5df862e920e4bd29b089c
Opcode Fuzzy Hash: 59a2d94db6ceabe75d488c1a27127b15107d824c2035617c1d08ac92aeb7720d
Instruction Fuzzy Hash: AA5188B091174ACFDB58CFA9D948BAEBBF1EF88314F24811DD809A7250DB749944CB61

Function 062CC610 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 062CC68E
GetCurrentThread.KERNEL32 ref: 062CC6CB
GetCurrentProcess.KERNEL32 ref: 062CC708
GetCurrentThreadId.KERNEL32 ref: 062CC761

Strings

`K, xrefs: 062CC78D

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: Current$ProcessThread
String ID: `K
API String ID: 2063062207-1731638711
Opcode ID: 178c8223cad1fbc4a17675a5ac30fc6b16fb2873e0594e1dc1f1d922bf9cf7b9
Instruction ID: 64c7e4f8ceef287eba8fa8684f1bcdd85a8d4a8e647b6d033000a10434158adc
Opcode Fuzzy Hash: 178c8223cad1fbc4a17675a5ac30fc6b16fb2873e0594e1dc1f1d922bf9cf7b9
Instruction Fuzzy Hash: DC5156B091174ACFDB58CFA9D948BAEBBF1EF88324F208119D809A7250DB749944CB65

Function 02B0F6F8 Relevance: 2.1, APIs: 1, Instructions: 614COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 02B0FEFB

Memory Dump Source

Source File: 00000004.00000002.4572932222.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2b00000_739077083533.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: ecdad8a6d7a04cb5ba0dbaf4e7e260c224edd9c828827f4e953369818b3a8f5e
Instruction ID: 5b2cb4547b7324b0dd0e159e98e1369e2918553b99e63aabdaa76017a57d41a2
Opcode Fuzzy Hash: ecdad8a6d7a04cb5ba0dbaf4e7e260c224edd9c828827f4e953369818b3a8f5e
Instruction Fuzzy Hash: F5420534B002058FDB25DB68C584BADBBB2FB49314F6485AAD409EB7A1DB75EC85CB40

Function 02B07308 Relevance: 1.6, APIs: 1, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02B072C8

Memory Dump Source

Source File: 00000004.00000002.4572932222.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2b00000_739077083533.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: bdcbf3757051df6c897d369322109b91de672221af7190ab3d726d357fa974fd
Instruction ID: 3a782550c80828554ebf6b6f560e372400e420ff676d6181d96e4be3eb1897c5
Opcode Fuzzy Hash: bdcbf3757051df6c897d369322109b91de672221af7190ab3d726d357fa974fd
Instruction Fuzzy Hash: 4A418170E1021ADFEB15CF65C48579EFBB5FF49310F1085A5E815EB280EB74A946CB90

Function 062C8AF3 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062C8C0A

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b9e8fda8bb4cd3df11a5647bce028655eaee2ca83b4c5604888a1eb5071d74cb
Instruction ID: 1d624f10c0b69165775aaede7e96202659b25947f4859add9ee9183414455f67
Opcode Fuzzy Hash: b9e8fda8bb4cd3df11a5647bce028655eaee2ca83b4c5604888a1eb5071d74cb
Instruction Fuzzy Hash: C541E2B1D10309DFDB14CF99C880ADEBFB5BF48350F20822AE819AB250D7759985CF90

Function 062C8AF8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062C8C0A

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 08d66ffaff7d3e0194447158ce932fa79f15deaf42423d851fd21f902d8a35cc
Instruction ID: 31940c0adae813d061155d058b178baafff3a5ffbb75aefb5135c66473f6e089
Opcode Fuzzy Hash: 08d66ffaff7d3e0194447158ce932fa79f15deaf42423d851fd21f902d8a35cc
Instruction Fuzzy Hash: EA41D2B1D10309DFDB14CF99C884ADEBFB5BF48350F24822AE819AB250D775A945CF90

Function 062CC40C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 062CD7B1

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: df7f942b3c5fa9c2e03ecac20536ef35697c9dee61f0f7864ca9bb6d43e543e8
Instruction ID: aee33ee81854e7fcc85635777cb41a2a346d29481aeacd20188469bd9db36fa6
Opcode Fuzzy Hash: df7f942b3c5fa9c2e03ecac20536ef35697c9dee61f0f7864ca9bb6d43e543e8
Instruction Fuzzy Hash: 20413BB8910305CFDB54CF59C488BAABBF5FF88324F248958D519AB321D775A845CFA0

Function 062CE42C Relevance: 1.6, APIs: 1, Instructions: 79
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 062CE4C0

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 20df688e4382f5cde54b501a2f4d6fafc05daf3b64fe65536c43d2f694b0c2cd
Instruction ID: 840c79152289590518427af4d8ed8b95fa7c681029e4624011c8eee554a14f6b
Opcode Fuzzy Hash: 20df688e4382f5cde54b501a2f4d6fafc05daf3b64fe65536c43d2f694b0c2cd
Instruction Fuzzy Hash: 053132B0D10348DFDB64CFA9C984BDEBBF5AF48714F208019E844BB290D7B4A845CBA1

Function 062CE438 Relevance: 1.6, APIs: 1, Instructions: 71
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 062CE4C0

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 0677b65829dd50edcc542ea2fb4d83cb452049699a221606477245b6d313d64a
Instruction ID: 1d5dd819088ba938f83f6b915ff6a7729d0394c07aebd5045c043afad069820c
Opcode Fuzzy Hash: 0677b65829dd50edcc542ea2fb4d83cb452049699a221606477245b6d313d64a
Instruction Fuzzy Hash: EF3100B0D01309DFDB54CF99C984B8EBBF5AF48724F208059E408AB290DBB4A845CBA1

Function 062CC850 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 062CC8DF

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 66bec8479fc2aa4282547e5213fc7e55e148826a1299f26b9bc6d5b5be3c312b
Instruction ID: f61a4bff55babf3431fad8370c2cd7bae28dcb8991abaf344b6967f2243579ba
Opcode Fuzzy Hash: 66bec8479fc2aa4282547e5213fc7e55e148826a1299f26b9bc6d5b5be3c312b
Instruction Fuzzy Hash: B221D2B5D002499FDB10CFA9D984AEEBBF5EB48360F14851AE918A3250D379A950CF60

Function 062CC858 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 062CC8DF

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c350f93ab6c14854e808a19bf2faf4e1816237ad2ae8db648b6e816b520eb2ec
Instruction ID: e6ee235f005bbf6afd36db4cc6ce297cfd46767800fe443fb791f26869f2264e
Opcode Fuzzy Hash: c350f93ab6c14854e808a19bf2faf4e1816237ad2ae8db648b6e816b520eb2ec
Instruction Fuzzy Hash: 0021E4B5D00249DFDB10CF9AD984ADEBBF8FB48320F14811AE918A3350D379A950CF60

Function 02B07251 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02B072C8

Memory Dump Source

Source File: 00000004.00000002.4572932222.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2b00000_739077083533.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 53656eb399a704c709a79ff5e39b5bd009a495a19d7b6425281c83d162fc3d27
Instruction ID: a5883471056f2ee0d8e3dc008beb122eae9f7a3cd698b178c7f5bb68e4e9eab3
Opcode Fuzzy Hash: 53656eb399a704c709a79ff5e39b5bd009a495a19d7b6425281c83d162fc3d27
Instruction Fuzzy Hash: 242158B2C0065A9FCB10CF9AC5847EEFBB0FF48320F148169D858A7240D778A945CFA0

Function 02B0FE79 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 02B0FEFB

Memory Dump Source

Source File: 00000004.00000002.4572932222.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2b00000_739077083533.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2a8dada10bceccb7427611e7c4e2c66058accf6fd98a6bfeaefb4c84f8ea5afb
Instruction ID: 8a466682daf7e4c4d89acd7122ee6b8a1b046aa2d435d3863af0cf6ace0214a7
Opcode Fuzzy Hash: 2a8dada10bceccb7427611e7c4e2c66058accf6fd98a6bfeaefb4c84f8ea5afb
Instruction Fuzzy Hash: 9C2115B1D002499FDB24DF9AD984BEEBBF5FB88310F108419E419A7250CB75A944CFA1

Function 02B07258 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 02B072C8

Memory Dump Source

Source File: 00000004.00000002.4572932222.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2b00000_739077083533.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b98f3ea90038df1806bd898e8a2f35a9bd2ced4ceadca805be96c30459245de4
Instruction ID: 5f0a75b69a11a3d32bef5cce6c0305a22943aa0c8e73917fc1e9488dd47aadfb
Opcode Fuzzy Hash: b98f3ea90038df1806bd898e8a2f35a9bd2ced4ceadca805be96c30459245de4
Instruction Fuzzy Hash: AC1138B1C0065A9BCB14CF9AC54479EFBB4EF48720F108159D818A7240D778A944CFA1

Function 062C6C80 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 062C7AB6

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7e952984cc403bbc0bd5c017676d526989cc0a837c32c979fa9b06057bb09392
Instruction ID: 6218e163a75a66b09ac35af04c585d4b57cbc224b85b4f3b37a82a2c5fce2bd0
Opcode Fuzzy Hash: 7e952984cc403bbc0bd5c017676d526989cc0a837c32c979fa9b06057bb09392
Instruction Fuzzy Hash: 191132B1C0074A8FDB10CF9AC444BDEFBF4EB88224F10851AD819B7200D3B9A644CFA1

Function 062CC464 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,062CD9FD), ref: 062CDA87

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d9e545f8329edf876aaa767016deb997198f8444923498fb290d17c01b168579
Instruction ID: 1c63e9870b271177c90b0748b1b93262ed2baa8ebc92075f5ffae8fc566a78a8
Opcode Fuzzy Hash: d9e545f8329edf876aaa767016deb997198f8444923498fb290d17c01b168579
Instruction Fuzzy Hash: 4B1125B1804349CFDB10DF9AD484BDEBBF4EF88320F208419D919A3200D3B5A944CFA5

Function 062CDD10 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 062CE345

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 886cc61bbedbf00132cc267ebd7655cc31ccfa0fc656f49cf9473b21c34208cc
Instruction ID: fe8c4947b5e6908ab2a7e4ea6ff1966961668defb8c00f959303322ed9de9b25
Opcode Fuzzy Hash: 886cc61bbedbf00132cc267ebd7655cc31ccfa0fc656f49cf9473b21c34208cc
Instruction Fuzzy Hash: 861133B1800349CFDB10DF9AC444BDEFBF4EB48320F20841AD918A3210D779A940CFA5

Function 062C7A4D Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 062C7AB6

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d2007b49e6727df71159eebbded34adfe1bfe89092f294aec6ccd6bc60d1cc55
Instruction ID: f186754032e40170d368cd1569212fb8f6cfac52cac1adcc83cde9bfc0606064
Opcode Fuzzy Hash: d2007b49e6727df71159eebbded34adfe1bfe89092f294aec6ccd6bc60d1cc55
Instruction Fuzzy Hash: 831110B6C0064A8FDB14CF9AC544BDEFBF4AF88324F14851AD819B7210C379A645CFA1

Function 062CE2E9 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 062CE345

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: dddbf01e686a6877fc938d3c859a242d6f9637ceb1dfc4643e39676f698ed268
Instruction ID: e6a7db66a6b345bd92749c98a8dc8307ab4420b7012c5e867c6c01b5e4019f85
Opcode Fuzzy Hash: dddbf01e686a6877fc938d3c859a242d6f9637ceb1dfc4643e39676f698ed268
Instruction Fuzzy Hash: B01103B5800349CFDB10DF9AD444BDEBFF8AB48324F248459E558A3210D779A544CFA5

Function 062CDA20 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,062CD9FD), ref: 062CDA87

Memory Dump Source

Source File: 00000004.00000002.4578938323.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_62c0000_739077083533.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5b1a30a870728149e10de0a9207e03c8916e245e785cdd90ecf94fc7b6b0770b
Instruction ID: 9cd887539a5ec881733580ade7548cb39ef9ab06fc0239e49ef7b08b4f232efb
Opcode Fuzzy Hash: 5b1a30a870728149e10de0a9207e03c8916e245e785cdd90ecf94fc7b6b0770b
Instruction Fuzzy Hash: 5611F2B18042498FDB10DF9AD844BDEBBF4AF88324F20885AD958A7250C7B5A544CFA5

Function 0115D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4572234172.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_115d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92022ee8907b4dab48697ad6223b7a5362fbc3d47b3c6cce8ccad3bcd4bca541
Instruction ID: fb6df7a604040db7e5b9506002cfec23c6a66df5639ae547e3990473a8b8b142
Opcode Fuzzy Hash: 92022ee8907b4dab48697ad6223b7a5362fbc3d47b3c6cce8ccad3bcd4bca541
Instruction Fuzzy Hash: 72210075604200EFDF59DF54E9C0B26BB61EB84314F20C56DDD1A4B252C77AD407CB62

Function 0115D104 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4572234172.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_115d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13cd30f080a59c9878b1b870b05a06dfe014973c67971bdd02b71ccd057a0a90
Instruction ID: fcba016a3333254f5bc01b6e124821c2552e9868b6caab17b82059b3eb9f1ad9
Opcode Fuzzy Hash: 13cd30f080a59c9878b1b870b05a06dfe014973c67971bdd02b71ccd057a0a90
Instruction Fuzzy Hash: 1F21F2B1504204EFDF49DFA4E9C0B26BBA5FB84314F20C56DED0A4B256C37AD446CB62

Function 0115D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4572234172.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_115d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99b148c547ddac76684d5c7cd1283fccac8c90842a418cb466938e67ec2a9b7
Instruction ID: e41e25ae1c319a0002e67fe6a2cbd45151b88dc9dabf4c4774bfdd97407e4fcc
Opcode Fuzzy Hash: c99b148c547ddac76684d5c7cd1283fccac8c90842a418cb466938e67ec2a9b7
Instruction Fuzzy Hash: EE21AC75509380CFDB07CF24D990B15BF71EB46214F28C5EAD8498B2A7C33AD80ACB62

Function 0115D0FF Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4572234172.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_115d000_739077083533.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d995b00d00e55cd09380dc6b4dc9fcb0e4c86312f1f46f4d8748a8c7f78b6f4c
Instruction ID: 6361194264a2455a4218333ea915ad71d564138d69b3fc4f102375980c3b4638
Opcode Fuzzy Hash: d995b00d00e55cd09380dc6b4dc9fcb0e4c86312f1f46f4d8748a8c7f78b6f4c
Instruction Fuzzy Hash: D411DD75504284CFDB0ACF14DAC0B15BFA1FB84218F24C6ADDC094B666C33AD44ACB52

Analysis Process: skyT.exePID: 2036, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	222
Total number of Limit Nodes:	13

Executed Functions

Function 02FBD490 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02FBD51E
GetCurrentThread.KERNEL32 ref: 02FBD55B
GetCurrentProcess.KERNEL32 ref: 02FBD598
GetCurrentThreadId.KERNEL32 ref: 02FBD5F1

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 63381cd84ad5cb346984f4ee28844a8fa88e5ed66db75750b6b4f6095c0f5522
Instruction ID: fd195daacb759e5bef17a648830a938aa320228a00afdd67f7b6fe17e84c152a
Opcode Fuzzy Hash: 63381cd84ad5cb346984f4ee28844a8fa88e5ed66db75750b6b4f6095c0f5522
Instruction Fuzzy Hash: 785189B09013498FDB15CFAAD548BDEBBF1EF88318F20845AD509A7350C7789944CF66

Function 02FBD4A0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02FBD51E
GetCurrentThread.KERNEL32 ref: 02FBD55B
GetCurrentProcess.KERNEL32 ref: 02FBD598
GetCurrentThreadId.KERNEL32 ref: 02FBD5F1

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cf7d5f6dba3722bbe53bbfc3f596bab2c731af7d50da87dba118bfd06dd58ca0
Instruction ID: eef991ff9679ca89a78f8b3a08f0a45b30f5c8b9809827ea933a848450f66b86
Opcode Fuzzy Hash: cf7d5f6dba3722bbe53bbfc3f596bab2c731af7d50da87dba118bfd06dd58ca0
Instruction Fuzzy Hash: F55177B09013498FDB14DFAAD548BDEBBF1EF88318F208459D509A7350CB78A944CF66

Function 077293E4 Relevance: 1.8, APIs: 1, Instructions: 253
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0772962E

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0862521023d9dbf1b35ea48c58988fa9ef7c1aca0664affcec9d6e08e0f2650d
Instruction ID: 9d078e7bf67f6b6efc08bfcfccb2ecc808e7b655b73f8a589581e22ab89279ec
Opcode Fuzzy Hash: 0862521023d9dbf1b35ea48c58988fa9ef7c1aca0664affcec9d6e08e0f2650d
Instruction Fuzzy Hash: 82A15CB1D00229CFDB10CF69C8407DDBBB2BF48354F188569E919B7280DB759986DF91

Function 077293F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0772962E

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 71f3615400eb64a2d5a74606807f51c164b0312d39f3d921ef65987c134ffd76
Instruction ID: 23117b859fcf391fb547f9f9c763be8c27fdba5583e83fa67884f44b4c086084
Opcode Fuzzy Hash: 71f3615400eb64a2d5a74606807f51c164b0312d39f3d921ef65987c134ffd76
Instruction Fuzzy Hash: E7914CB1D00229CFEB10CF69C8407DDBBB2BF48354F188569E919B7280DB75A985DF91

Function 02FBB208 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02FBB45E

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 80423d9eb4151c48e09bd52075b812d4ac233471584e8ffef8831d29149b48e9
Instruction ID: 404e27418f85a963568cb9a63b1a56e38422a83c6f04b3979e813a57802def3f
Opcode Fuzzy Hash: 80423d9eb4151c48e09bd52075b812d4ac233471584e8ffef8831d29149b48e9
Instruction Fuzzy Hash: 73814570A00B098FDB25DF6AC54579ABBF2FF88348F00892ED55A9BA40D775A845CB90

Function 02FB5D1C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02FB5DD9

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1aea1d9cd4e999109dc2653b22fc4abc1ff1a7c3e3be0ea750c0573b515f4885
Instruction ID: a8802b038aa8c802655891b85951495fc5daf009fd23d54ad35cc183ca1f9b34
Opcode Fuzzy Hash: 1aea1d9cd4e999109dc2653b22fc4abc1ff1a7c3e3be0ea750c0573b515f4885
Instruction Fuzzy Hash: F141EFB0C0071DCBEB25CFAAC984BCEBBB5BF48704F60816AD509AB251DB756946CF50

Function 02FB4874 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02FB5DD9

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 45a631f5d0a41c0ed6745b3f216298e3ab18627ea2329ccc101e0f8294bc2f08
Instruction ID: 534e78316686a6a13a66403a5d0e9f46eff4848c2479b2fe948d970031dc4ea4
Opcode Fuzzy Hash: 45a631f5d0a41c0ed6745b3f216298e3ab18627ea2329ccc101e0f8294bc2f08
Instruction Fuzzy Hash: A7410070C0071DCBEB25CFAAC984BDEBBB5BF48304F60816AD509AB251DB756945CF90

Function 07728D68 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07728E00

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 43370739c9238b7172219b75b89499c3278e7c3b56d90ef332099e4aed49dcef
Instruction ID: 8d44578b106a0024fd050bb616b78fa994f3e6c7fe78c3609ec1839e4c052f96
Opcode Fuzzy Hash: 43370739c9238b7172219b75b89499c3278e7c3b56d90ef332099e4aed49dcef
Instruction Fuzzy Hash: 4C216BB19003199FDF10CFA9C8817EEBBF5FF48320F10882AE518A7241C7799954CBA5

Function 07728D70 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07728E00

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6d78523c40a65031a21588d1c6c77e0a3dfee8f0e58583d53fca2d03cb5dc947
Instruction ID: f2bf98a29782a79ec3b906c5272d662f327e91da151e829c9827691e85978bd9
Opcode Fuzzy Hash: 6d78523c40a65031a21588d1c6c77e0a3dfee8f0e58583d53fca2d03cb5dc947
Instruction Fuzzy Hash: B72126B19003599FDB10CFAAC881BDEBBF5FF48310F10882AE919A7241C7799954DBA5

Function 07728E58 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07728EE0

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ed7b0fa26eb4b1034211821eb4d6e13890fd546effa1332b3da9816034035efb
Instruction ID: b1258f936a34dba5053aa32af8a9f9517281b724c1a604d698b9e45642299caa
Opcode Fuzzy Hash: ed7b0fa26eb4b1034211821eb4d6e13890fd546effa1332b3da9816034035efb
Instruction Fuzzy Hash: 1C213BB1D003599FDB10CFAAC8417EEBBF5FF48320F10842AE519A7240CB799540DBA5

Function 07728BD3 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07728C56

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 893460f84db88ba71accf20f9b7917934b5d3f4945645d357201fc926ee67a1e
Instruction ID: 0955cfa60445b7131ac51bb1127ed0257bdf3281086e100cef87843bcb4860e2
Opcode Fuzzy Hash: 893460f84db88ba71accf20f9b7917934b5d3f4945645d357201fc926ee67a1e
Instruction Fuzzy Hash: C6216AB19003198FDB10DFAAC4817EEBBF4EF88320F14842AD519A7240CB789585CFA5

Function 07728E60 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07728EE0

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 608dffd51c05f7874d6b610ddec91495caa5aa8b866d8b65c4cec00f703da68d
Instruction ID: 595af1b186bacc73cbb8f57c21c1db4860b6e398d4bedcbc9bfab99c5158a8d4
Opcode Fuzzy Hash: 608dffd51c05f7874d6b610ddec91495caa5aa8b866d8b65c4cec00f703da68d
Instruction Fuzzy Hash: D12128B1C003599FDB10DFAAC881BDEBBF5FF48320F10842AE519A7250C7799550DBA5

Function 07728BD8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07728C56

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 28480cd75eb48cd09b7c98278a6483469860d9f79280d0335959589dc5272edc
Instruction ID: d59a508b29cb709d57ea79d840322dd56a6c858228c37e2455cd3373138b217c
Opcode Fuzzy Hash: 28480cd75eb48cd09b7c98278a6483469860d9f79280d0335959589dc5272edc
Instruction Fuzzy Hash: AA2149B1D003198FDB10DFAAC4857EEBBF4EF88320F14842AD519A7241CB79A945CFA5

Function 02FBD6E8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02FBD76F

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 742d8abe2407e21d116fff21b821f2b9c47129adfefbf61873bb6607e6b1c001
Instruction ID: cfd95d51b804b3d016df0d1c4a3283c05c987d00b5eb7a9ec734bc31a38eeac0
Opcode Fuzzy Hash: 742d8abe2407e21d116fff21b821f2b9c47129adfefbf61873bb6607e6b1c001
Instruction Fuzzy Hash: 5521E4B59002099FDB10CFAAD984ADEBFF4FF48320F24841AE914A3310D375A954CF61

Function 02FBD6E1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02FBD76F

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 11cafc8cccc5b144942f32745d396a54f89121a1ecfcc11e012d59b7f526e5c8
Instruction ID: 48b24cb89164cfe53dca75614933cca874373a4c6c9a0ffd7ad90d4edd5d7bd6
Opcode Fuzzy Hash: 11cafc8cccc5b144942f32745d396a54f89121a1ecfcc11e012d59b7f526e5c8
Instruction Fuzzy Hash: 1D21B3B5D002099FDB10CFAAD584AEEBBF5AF48324F24841AE914A7250D379A954CF61

Function 07728CA8 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07728D1E

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3280b23d096a4ca7aefb0f14259f9e5ef637662230dc5097da1221c8e24b1b43
Instruction ID: 12c04d6ad58c56dd4b03986cbaea419d9c6594b059702d685fec92a2b55f6177
Opcode Fuzzy Hash: 3280b23d096a4ca7aefb0f14259f9e5ef637662230dc5097da1221c8e24b1b43
Instruction Fuzzy Hash: E9116AB18003499FDB10CFAAC840BDFBBF5AF48320F108819E515A7210C775A550CFA1

Function 02FBAC10 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02FBB4D9,00000800,00000000,00000000), ref: 02FBB6EA

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 455eda6ee06710506bba34e9d91410cb5d3245faf17f7f3d568d6da99d1b79a3
Instruction ID: 430fc1b50edd495927069c5b9131d0e1364bd4117341f29aa3495f8cc54c522d
Opcode Fuzzy Hash: 455eda6ee06710506bba34e9d91410cb5d3245faf17f7f3d568d6da99d1b79a3
Instruction Fuzzy Hash: 4E1106B6D003499FDB10CFAAC844BDEFBF5AF48324F10845AD915A7200C3B5A944CFA5

Function 07728B20 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07728B8A

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2ab670ece5ad487d7f7c1bf4fd1e4fbe07f45a740470892837e7a989e7a64ec6
Instruction ID: 89e4e9725fb5a3055e0f1d31aae9093060db940af6c342d4c5eb7d355b37bdd9
Opcode Fuzzy Hash: 2ab670ece5ad487d7f7c1bf4fd1e4fbe07f45a740470892837e7a989e7a64ec6
Instruction Fuzzy Hash: 57118BB19003498FDB10DFAAC4457EEFBF4AF88320F14881ED119A7240CB76A445CBA5

Function 02FBB679 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02FBB4D9,00000800,00000000,00000000), ref: 02FBB6EA

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6b6e0fb93cefe52e3814914d5fd8c6ac8c6f94f87ef62064f7cce481ae0352c0
Instruction ID: eb9d359651f9c1ec42e278bc07526db1d519d9e9cee70b3270dca7b120d0240a
Opcode Fuzzy Hash: 6b6e0fb93cefe52e3814914d5fd8c6ac8c6f94f87ef62064f7cce481ae0352c0
Instruction Fuzzy Hash: 1B1114B6D002498FDB10CFAAC484BDEFBF5EF48324F10845AD919A7210C3B5A545CFA5

Function 07728CB0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07728D1E

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f0d82c509577f38bb98ec864dcbd833d6c76a627b6c7d7788cd301b6b8ef04f5
Instruction ID: be3ada85107427db2ffc411773d099843e06af4112a889dd39831e63293ceb18
Opcode Fuzzy Hash: f0d82c509577f38bb98ec864dcbd833d6c76a627b6c7d7788cd301b6b8ef04f5
Instruction Fuzzy Hash: 811126729002499FDB10DFAAC845BDFBBF5AF88320F148819E519A7250CB76A954CFA1

Function 0772CF81 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0772CFE0

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c3e6f74bea64285c84c8f2f1a193dca8cb808eaf0f67ca75490bfd7c955cabe6
Instruction ID: 537168f52da449a6dba067614f0adce4600b51dffc6f3aa062323bcbb973fe66
Opcode Fuzzy Hash: c3e6f74bea64285c84c8f2f1a193dca8cb808eaf0f67ca75490bfd7c955cabe6
Instruction Fuzzy Hash: D71155B2800349CFCB20CFAAC444BEEBFF4EB48320F20845AD558A7241D779A584CFA5

Function 07728B28 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07728B8A

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ec3de0f513c8ebbec849a7065fec1988512d66c08343ffd7d5ebeb0ca7142da8
Instruction ID: 5a09253256fc083948b34cecf76dfd5fb00fd36034b4f707c384f166e6b81d48
Opcode Fuzzy Hash: ec3de0f513c8ebbec849a7065fec1988512d66c08343ffd7d5ebeb0ca7142da8
Instruction Fuzzy Hash: E8113AB19003498FDB10DFAAC44579FFBF5AF88724F24881DD519A7240CB75A544CB95

Function 02FBB721 Relevance: 1.5, APIs: 1, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02FBB4D9,00000800,00000000,00000000), ref: 02FBB6EA

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6fd65e55fcd8992b81fe2fda5c354dfe8bd26541b2fdcb05e2bdcbc33f0366b3
Instruction ID: 8c72e2a2fb243f0f84903c54b007ca5d757feea1e237f821c41d0e780428c6f5
Opcode Fuzzy Hash: 6fd65e55fcd8992b81fe2fda5c354dfe8bd26541b2fdcb05e2bdcbc33f0366b3
Instruction Fuzzy Hash: E001F5719043088FDB11CFA9D8447DABBF4EF56328F14409AD604D7250C3B59405CFA5

Function 07729078 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0772BDFD

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b3b8ca4a998eaf49d22ab6a4b36017e52dc4196d9c5864b504b03d2020c70b80
Instruction ID: df17c25cf8830ec99dda9eb5c36a0e942f5ee4ca2185dfa66f06fccf40d0c0c1
Opcode Fuzzy Hash: b3b8ca4a998eaf49d22ab6a4b36017e52dc4196d9c5864b504b03d2020c70b80
Instruction Fuzzy Hash: CF11F2B58003599FDB20DF9AC444BDEBBF8EB48320F20845AE518A7211D3B5A954CFA5

Function 0772CF88 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0772CFE0

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 35f170042a5d7ae1c6edb9bdfb7168b4c5220e08e35669ea44026704a5efadc6
Instruction ID: 56abf61883f8d40bf120ec2a6a201dc41fd1b4a741c84c0a15e46eda9b08175b
Opcode Fuzzy Hash: 35f170042a5d7ae1c6edb9bdfb7168b4c5220e08e35669ea44026704a5efadc6
Instruction Fuzzy Hash: A71103B6800359CFDB10DF9AC545BDEBBF4EB48320F20841AD568A7241D779A544CFA5

Function 02FBB3F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02FBB45E

Memory Dump Source

Source File: 00000006.00000002.2293874364.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fb0000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c037390feb80b1af8ab08e210f513529359241bc0e58dd739733294da20a4924
Instruction ID: 8443331e4c92763e03bcf7fd84326bee1544e90d68bd67ce2f54d1d338af8c3e
Opcode Fuzzy Hash: c037390feb80b1af8ab08e210f513529359241bc0e58dd739733294da20a4924
Instruction Fuzzy Hash: B311DFB6C00649CFDB10CFAAC544BDEFBF4AF88628F10845AD919A7210D779A545CFA1

Function 0772BD9B Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0772BDFD

Memory Dump Source

Source File: 00000006.00000002.2297912709.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7720000_skyT.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 63cac19354e53f4e4de57277376c2b6d491204602598c686112ff8a32f11a494
Instruction ID: f6f13f8ba9da1ee570d77a2033fb2ef1e88443e0c1b247bf2e89edba4c3bebba
Opcode Fuzzy Hash: 63cac19354e53f4e4de57277376c2b6d491204602598c686112ff8a32f11a494
Instruction Fuzzy Hash: 221103B5800349DFDB10DF9AC445BDEBBF4FB48320F20885AD918A7211D375A954CFA1

Function 0172D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2293519938.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_172d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fdbd9893ec547b3869516a7298b83f186c29d930c94b62c4ea9bb61c141d413
Instruction ID: 0a6a4c43a898935897b5f02b7811449cffb6af26eafa723e8bd812fbf56a8360
Opcode Fuzzy Hash: 1fdbd9893ec547b3869516a7298b83f186c29d930c94b62c4ea9bb61c141d413
Instruction Fuzzy Hash: CC2103B2504240EFDB25DF55D9C0B26FF65FB88318F30C5ADE9090B256C376D456CAA1

Function 0173D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2293571024.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_173d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f6d34748c4afe14649e3ac969f02e128ab585b1a83990b825e509113037428
Instruction ID: d4639644c058af67e9edcd4190eb71dc7029270a816b10fb9b61d4fce9ee0235
Opcode Fuzzy Hash: 91f6d34748c4afe14649e3ac969f02e128ab585b1a83990b825e509113037428
Instruction Fuzzy Hash: C92100B5604204EFDB25DFA4D9C0B26FB65FBC8B14F60C5ADE94A0B253C37AD406CA61

Function 0172D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2293519938.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_172d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 9eb18a174c45a1da3eeece63996d3909d0731fa008ecd80f1dd6adbaea44d3be
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 8711CD76404280CFCB12CF54D5C0B16BF62FB84218F34C6A9D8090B256C33AD456CBA1

Function 0173D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2293571024.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_173d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 6e88b6faf8e80bd97ec7941f5cf75dbd5b588579d9cfd646fd0d5455cb7e3274
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: BF11DD76504284CFCB22CF54D5C4B15FFA2FB88714F24C6AAD8494B657C33AD40ACBA2

Function 0172D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2293519938.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_172d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbd9661e4a5e2411f661a1678f8b065fa8be0e4c96e68d56f4e1451b3661ca2
Instruction ID: 6346fb9b002b2350e30b959ed7a495fbafd56fc374509e39b5ac9a9e273e89d2
Opcode Fuzzy Hash: 6cbd9661e4a5e2411f661a1678f8b065fa8be0e4c96e68d56f4e1451b3661ca2
Instruction Fuzzy Hash: F901F2710043949AF7204AAACD80B66FF98EF41320F18845AEE094A397C7BC9841C6B2

Function 0172D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2293519938.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_172d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371473835d98bb43560857a59460a5bfecfd737161dd6c24b1dd9bce1a55dd5d
Instruction ID: 8b2d3862459095de06bc5eef3917c102752c2ca4170db82acf6661e565811620
Opcode Fuzzy Hash: 371473835d98bb43560857a59460a5bfecfd737161dd6c24b1dd9bce1a55dd5d
Instruction Fuzzy Hash: F0F0C2714053949EE7208A5ADC84B62FFA8EF50734F18C45AED080B387C379A844CAB1

Analysis Process: skyT.exePID: 1396, Parent PID: 2036COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	93.9%
Signature Coverage:	0%
Total number of Nodes:	231
Total number of Limit Nodes:	22

Executed Functions

Function 02C59628 Relevance: 2.9, Instructions: 2885COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79aa7837909f5316db0416197d57c63dac9ff182a51a895fd2dfaf4def502504
Instruction ID: 569efa6fbcd90bdd25905cde27b4c8d70784d936f71a3c305d8101df6515c343
Opcode Fuzzy Hash: 79aa7837909f5316db0416197d57c63dac9ff182a51a895fd2dfaf4def502504
Instruction Fuzzy Hash: A863F831D10B1A8ADB11EF68C884A99F7B1FF99310F15D79AE44877121EB70AAC5CF81

Function 02C5CAE8 Relevance: 2.3, Instructions: 2295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67471b95b5c7a461912ffa136808caa007a3a2dc2e216d29766d961cc59b5c1b
Instruction ID: a30fc47b114a2965db81949bd8984c60729991b7f6e26a7a9ec7ec3f4ad903af
Opcode Fuzzy Hash: 67471b95b5c7a461912ffa136808caa007a3a2dc2e216d29766d961cc59b5c1b
Instruction Fuzzy Hash: 36332D31D10B598EDB11EF68C8846ADF7B1FF99300F14D69AE449A7211EB70EAC5CB81

Function 02C591D8 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f5551619a36ace8fa2161b8fca10c6d771d8a3252b073fadd05b0a4e804aa7
Instruction ID: bbe6b4dcaea19990c02bff7c3cdced67945926e777f4257f945f943021a4aaf0
Opcode Fuzzy Hash: b8f5551619a36ace8fa2161b8fca10c6d771d8a3252b073fadd05b0a4e804aa7
Instruction Fuzzy Hash: 04C1AE70A00215CFDB14CFA9D8807AEB7B6FF88310F1485AAE909DB395DB74D981CB95

Function 02C58E5C Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bedc2e78fd4fb350ade3999917a5214354e20462851054d98b087f118b62a88
Instruction ID: 8d6697913bf466d78b4145a72322e958287222e12fa4b11eab185134635e6f23
Opcode Fuzzy Hash: 9bedc2e78fd4fb350ade3999917a5214354e20462851054d98b087f118b62a88
Instruction Fuzzy Hash: 80D17F35A00225CFDB14DBA5D884AAEBBF6FF88310F144569E805EB394DB75DD81CB90

Function 02C54AA8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084db95b0c3f65fa6d92499c47b311ef368e685f3c9d649b95b84b7b2eda3132
Instruction ID: dd62d4ad8ef0e4605f0728db6a1ecafb10029571e511d62356e64b4166f9859c
Opcode Fuzzy Hash: 084db95b0c3f65fa6d92499c47b311ef368e685f3c9d649b95b84b7b2eda3132
Instruction Fuzzy Hash: 0BB16C70E006298FDB28CFA9C88179DBBF2AF88714F148529D815E7294EB74D9C1CF95

Function 02C53E90 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b86a0f24feaf3f5b78e67fb876bf2a3a75916df07c2c2bbfe7af7ef8d76885
Instruction ID: 51636f022dd78245c5d71b3a7fed65a6d366a7cdb733f9fa18188f6b4d75e6ce
Opcode Fuzzy Hash: e5b86a0f24feaf3f5b78e67fb876bf2a3a75916df07c2c2bbfe7af7ef8d76885
Instruction Fuzzy Hash: 32917D70E00259CFDF24CFA9C98579EBBF2AF88714F148129E814A7254EB35D985CF89

Function 0638796E Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06387936

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 48a7434d44e9b541bf35d9f928cf1e36a8efc128c9c7c9992ebb28550ffbde0a
Instruction ID: ba76abeb15df40ce4ebf229d4397ddd54e20bad1944ef0f33cb87e95cea4f978
Opcode Fuzzy Hash: 48a7434d44e9b541bf35d9f928cf1e36a8efc128c9c7c9992ebb28550ffbde0a
Instruction Fuzzy Hash: BF4151B1D103498FCB54DFA8C884BDEBBF2AB08310F20852AE819A7340D3789549CFA1

Function 06388972 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06388A8A

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cfd842554e65b15957fc4aecd4674687bcca03514e669519a334b05529233584
Instruction ID: 4315056a64fc1706038d149d4d92c067164dc2708174651d083696f2eba6ce5b
Opcode Fuzzy Hash: cfd842554e65b15957fc4aecd4674687bcca03514e669519a334b05529233584
Instruction Fuzzy Hash: F751C0B1D00349DFDB14CF9AC884ADEBFB5BF48310F64862AE819AB250D7759945CF90

Function 06388978 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06388A8A

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4a23585613f945be647234830b89af9b1cd0d318cdd712a5ba0debed26786159
Instruction ID: 76c2f878e4085f408196507296466951f68a8f2d97b9cc7ab1e0f67943822d83
Opcode Fuzzy Hash: 4a23585613f945be647234830b89af9b1cd0d318cdd712a5ba0debed26786159
Instruction Fuzzy Hash: 5741BEB1D00349DFDB14DF9AC884ADEBBB5BF48310F64862AE819AB250D775A845CF90

Function 0638C28C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0638D631

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 78702a2635f11aef6bdac20ebfae32c0333aec7611f6efd8becf41098f4111df
Instruction ID: e2ec526a6c483ea7069401a66c5719ef0b642d40bbe4812eba28cbdbfcdec5ee
Opcode Fuzzy Hash: 78702a2635f11aef6bdac20ebfae32c0333aec7611f6efd8becf41098f4111df
Instruction Fuzzy Hash: C94149B8900309CFDB54DF99C488AAABBF5FF88314F248449D519AB361D774A840CFA0

Function 0638E2AC Relevance: 1.6, APIs: 1, Instructions: 79
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0638E340

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 737d89e781a97ac065c4147cc0abc0cc605b31263f1ef95d8e4522ff9ef91884
Instruction ID: 120a842e83c7980304f5a9c9a28127516735764b2565a60422604ca97b95faa9
Opcode Fuzzy Hash: 737d89e781a97ac065c4147cc0abc0cc605b31263f1ef95d8e4522ff9ef91884
Instruction Fuzzy Hash: D73101B0D00308DFDB54DF99C984BDEBBF5AB48714F248059E444AB3A0D7B4A845CBA5

Function 0638DCA8 Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0638E340

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 03721a8427f96d31731bdf8d29fe7cb7553edb7330c3926b0f005682300008fa
Instruction ID: d44f53adfde88f65aeec86c712704c05a5f71d636eb9742aee4ddda2dd89a0c5
Opcode Fuzzy Hash: 03721a8427f96d31731bdf8d29fe7cb7553edb7330c3926b0f005682300008fa
Instruction Fuzzy Hash: 42310FB0D01308DFEB50DF99C984BDEBBF5AB88714F248059E404BB3A0D7B4A845CBA5

Function 0638C6D0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0638C75F

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 98a144d1957190538d52da5e4ae43feb461b007e873e4ee6a252faff3ea45402
Instruction ID: 848ca060333bd6450cbd34732b9c9ebb0d1c26a35796516de3344535b43752c5
Opcode Fuzzy Hash: 98a144d1957190538d52da5e4ae43feb461b007e873e4ee6a252faff3ea45402
Instruction Fuzzy Hash: CF21E5B59002499FDB10CFA9D984ADEBFF5EB48310F24845AE914A3350D374A954CFA4

Function 0638C6D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0638C75F

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 85c6e74ddf20f0d312d204f6d26e1bcf66c5e1535ea2a63adb7477fcf6fde665
Instruction ID: b8a831595fb7695491451080f02b33b346c13821afcbd11fd1e6ea2c9c9bbf23
Opcode Fuzzy Hash: 85c6e74ddf20f0d312d204f6d26e1bcf66c5e1535ea2a63adb7477fcf6fde665
Instruction Fuzzy Hash: E921E4B5900349AFDB10CFAAD984ADEBBF4FB48320F14841AE914A3310D374A954CFA4

Function 0638FE01 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0638FE83

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 8f545eda4ab9f41d5781e48cdec0e687aca660eabfb61ddccd3327b255518669
Instruction ID: 657e8fac3873023dad46457049b4ba4dfc17776592e8583badc3de2820efb3df
Opcode Fuzzy Hash: 8f545eda4ab9f41d5781e48cdec0e687aca660eabfb61ddccd3327b255518669
Instruction Fuzzy Hash: 072134B1D0034A9FDB10DFAAC844BEEFBF5AF88320F10842AD458A7250C774A944CFA1

Function 0638FE08 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0638FE83

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bf9b59616e549c733bbb8fc4115f0fd7819f284f237bae4f64b2c468ef129aca
Instruction ID: c20936f93b6aeef2d6e6b6bdf9172c8d67e826b894f6f80088f0de44ab0f7da2
Opcode Fuzzy Hash: bf9b59616e549c733bbb8fc4115f0fd7819f284f237bae4f64b2c468ef129aca
Instruction Fuzzy Hash: 342124B5D0024A9FDB54DF9AC844BEEFBF5BF88320F10842AD418A7250CB75A944CFA1

Function 06385E44 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06387936

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 34ab00e8bb4f0b6e10648a9a006618d1a2b121e67f158c17342cc4f96e908d49
Instruction ID: d8ae218feefea28da3ba72f759112d00f348c0662fd2d46495444bc163a5ce5d
Opcode Fuzzy Hash: 34ab00e8bb4f0b6e10648a9a006618d1a2b121e67f158c17342cc4f96e908d49
Instruction Fuzzy Hash: CE1102B6C007498FDB10DF9AC484BDEFBF5EB88224F24846AD429B7600D379A545CFA5

Function 0638E169 Relevance: 1.5, APIs: 1, Instructions: 47
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0638E1C5

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c83ebf32f207fac9296491b58cc37daff9a86175e3bf44c8bd7c5351583f9392
Instruction ID: aec073867d367c01f0a4afcc8c49c6efcc141f0c1fe9222e2e36f4094f0aa332
Opcode Fuzzy Hash: c83ebf32f207fac9296491b58cc37daff9a86175e3bf44c8bd7c5351583f9392
Instruction Fuzzy Hash: C01122B5900349CFCB20DFAAC884BDEFBF4EB48224F248859E558A7200D374A944CFA5

Function 0638C2E4 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0638D87D), ref: 0638D907

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: e8376c9719ba6c91bc176b18b97b543372b726520262ce14d70f934568dad1bb
Instruction ID: 2045fe0a947da0510300c7b5b78a2f5bd6ad692af4160f7eb73f8bfa3240ad97
Opcode Fuzzy Hash: e8376c9719ba6c91bc176b18b97b543372b726520262ce14d70f934568dad1bb
Instruction Fuzzy Hash: 1D1122B58003498FDB60DF9AD484BDEBBF8EF48224F20845AD518A3240D3B8A944CFA5

Function 0638DB90 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0638E1C5

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e29a4167bb0b9e05663bf79844257a7d458f630d5c56bfc27c3ab77473f69f66
Instruction ID: 67c2b182ac7c69d6ab9f8e1bf32b6461bd6096b9a9db99ad08154fe4ea73f50c
Opcode Fuzzy Hash: e29a4167bb0b9e05663bf79844257a7d458f630d5c56bfc27c3ab77473f69f66
Instruction Fuzzy Hash: 3F1115B5900349CFDB60DF9AC884BDEBBF4EB48324F208459E519A7600D375A944CFA5

Function 063878CD Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06387936

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6b618f87822ff59462411025b67bd3bf99a41473e27c57a8fbdd6f8b1e474905
Instruction ID: fc3a9200fedae9ad3472f85a50536dc6910069a424fa935ae4ab8dc0c0422beb
Opcode Fuzzy Hash: 6b618f87822ff59462411025b67bd3bf99a41473e27c57a8fbdd6f8b1e474905
Instruction Fuzzy Hash: EE1110B6C003498FCB10DF9AC984BDEFBF5AF88224F24845AC468B7200D379A545CFA0

Function 0638D8A0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0638D87D), ref: 0638D907

Memory Dump Source

Source File: 00000007.00000002.4578750796.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6380000_skyT.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f65c4c1fa37542cb472724c7e8d108ffe3e091ced830f2a7ef69f09fb7bc01d8
Instruction ID: ff60e3c4bc57735207c05242b424d9d1406d739ff8db47259fbbdad764d53355
Opcode Fuzzy Hash: f65c4c1fa37542cb472724c7e8d108ffe3e091ced830f2a7ef69f09fb7bc01d8
Instruction Fuzzy Hash: 4F1122B1800349CFDB20DF9AD884BDEBBF4EF48324F20845AD568A3240D7B4A944CFA5

Function 02C571E8 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

5, xrefs: 02C571E8

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: f5fcac862b1cea50ed5edeb124bf48ff52a05a28ec59089242c8e79212e501b1
Instruction ID: 8d9980f5b5460cd2e2b44611d35643580fc2b43fe7b042747a651db2aa65ca3d
Opcode Fuzzy Hash: f5fcac862b1cea50ed5edeb124bf48ff52a05a28ec59089242c8e79212e501b1
Instruction Fuzzy Hash: F4417E30E00269DBDB15DBA5C84479EF7B6EB85304F108529E806EB294EB74D9C6CB54

Function 02C5772F Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e569ce2248e788e5df382a8b765a37a6e882b2e2a1961eb364f14d1c7b8036f
Instruction ID: f0f6b6d1bf31c8c511bcc5425aec667dd3318f95efc929595192ab63ede55020
Opcode Fuzzy Hash: 5e569ce2248e788e5df382a8b765a37a6e882b2e2a1961eb364f14d1c7b8036f
Instruction Fuzzy Hash: D4B14D30700122CBDB29AA69E49872877A2FBDA355F50492DE505DF394CFB5E986C780

Function 02C57780 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e319eac435573f75ac8e85233a72e17aae1f9dd5303728a501eca8a9c714cb
Instruction ID: 4aa4fb5242a2a4f43e1bbe3f8dc64bb66509cb7724c045f2f5dc0aaa49fcbd1f
Opcode Fuzzy Hash: 18e319eac435573f75ac8e85233a72e17aae1f9dd5303728a501eca8a9c714cb
Instruction Fuzzy Hash: 28B15E307001138BDB29AA69E48871877A6FBD9355F50492DE505DF394CFB5ED86C780

Function 02C54A9C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea982749581e25f7d1abb2f29c7462dec5a11d53cc6e6aa7bf9c0d15109e260d
Instruction ID: 4679a13e59525d8f1fabe0fc8b89e9c2cdfbad00d5ec0a7c749dbc7955793869
Opcode Fuzzy Hash: ea982749581e25f7d1abb2f29c7462dec5a11d53cc6e6aa7bf9c0d15109e260d
Instruction Fuzzy Hash: 88A16A70E00A298FDB24CFA9C88179DBBF2AF88714F148129D815E7294EB74D9C5CF95

Function 02C53E86 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499917ee4323b8cdc6101f43b328bb97ad1c094fac2e8e348bc4d9b4c6666d66
Instruction ID: 4e78cbcaa2f7aad17134e5f4a78cdfb6e8254d5b4793ffa3d0ac6ba46c798b9a
Opcode Fuzzy Hash: 499917ee4323b8cdc6101f43b328bb97ad1c094fac2e8e348bc4d9b4c6666d66
Instruction Fuzzy Hash: 80917C70E00259CFDB24CFA9C98579EBBF2AF88704F148129E814A7254EB35D985CF89

Function 02C56CE6 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5dccb8daec9fd4645909695808153e2553f6ae4e3ac22c744b23a9d9948fa63
Instruction ID: 7d6ff9e929d8afbfa60cfd5434c3638e6e285e2a9f349e75ddcaf7b9d9be40b6
Opcode Fuzzy Hash: a5dccb8daec9fd4645909695808153e2553f6ae4e3ac22c744b23a9d9948fa63
Instruction Fuzzy Hash: 8A5127B4D002688FDB14CFAAD884B9DBBB5FF48314F648519E815BB350D7B4A884CF94

Function 02C51128 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130d508c5e1bf4baae110882ccd9502724de9ee643a099d20658db0fde055d77
Instruction ID: 93006df4cb1b10fd4f0173129b0b293ba9a0b6b1c253eb1fd223ce523d4187d2
Opcode Fuzzy Hash: 130d508c5e1bf4baae110882ccd9502724de9ee643a099d20658db0fde055d77
Instruction Fuzzy Hash: BE51F9716052638FCB69EF2AF881D593FB1EBA13053049B69D2045B2BEEE747945CF80

Function 02C56CF0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf03dbec2ccd89724604389a0bde040856e981ca5557b0be8047e682a72615b5
Instruction ID: 2866763e38c2963257a79638477d76996a07a533d2582c34dc18046d6b5409cc
Opcode Fuzzy Hash: bf03dbec2ccd89724604389a0bde040856e981ca5557b0be8047e682a72615b5
Instruction Fuzzy Hash: 795127B0D002688FDB14CFAAD884B9DBBB5FF48314F648519E815BB350D7B4A884CF98

Function 02C5EEF0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180845c9deb60633075da5cd5964afb7aa2527b09a7d0e305fb0795d436e58f8
Instruction ID: 2a765734a8e11ca8d8ebc5fc8f7e8f54c2e60fbfa5d603ae2d84b1ec2667cd19
Opcode Fuzzy Hash: 180845c9deb60633075da5cd5964afb7aa2527b09a7d0e305fb0795d436e58f8
Instruction Fuzzy Hash: EA41F475E002598FDB16CF64C85479ABBF6BF89300F14865DE846EB381EB71E982CB40

Function 02C5F02D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13e0cabf6b99ff8da405dc5ff8ba22a9b89f802ab133744c399bb795b0a7355
Instruction ID: 0355410028cba933edd920b2b2360fb12829158cdafb6a4434ca65b810f6c7d0
Opcode Fuzzy Hash: c13e0cabf6b99ff8da405dc5ff8ba22a9b89f802ab133744c399bb795b0a7355
Instruction Fuzzy Hash: D0311F30B002268FDB19AB35D95066F7BA2AFCA604F14442CC806DB799EF31CD82C7D4

Function 02C54F98 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e44e395104e0ad50aa0441da3567bb89b75dee496c348e0643ec3fe6ec88577
Instruction ID: f72f3cea040e7fe0a8d7265774155673fd7687d424916bc6e092e2f4beb43561
Opcode Fuzzy Hash: 6e44e395104e0ad50aa0441da3567bb89b75dee496c348e0643ec3fe6ec88577
Instruction Fuzzy Hash: CD41DC316002158FCB24DF79D818B9DBBF1AF89218F2005A8E90AE7360DB32DD81CB95

Function 02C51138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3063c285554bb51fa2e1a5363134f98fd64f928e12c09609b179fc30bcb54e
Instruction ID: 5f53908fc996cf4c63dc40e37d241e8405aa9f0cdb1f13cdd3cfe5b2c56b1208
Opcode Fuzzy Hash: 3c3063c285554bb51fa2e1a5363134f98fd64f928e12c09609b179fc30bcb54e
Instruction Fuzzy Hash: 5A51A8306452638FCB69EB2AF881D583FB2BBA13053049B69D2045B27EEE747945CF90

Function 02C571F8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d346e727850226258f51c974387f84fe26b6e1305cb1ebba1c01e11b764c5a6
Instruction ID: daf3bb091a5aae9ab31c9dc272236fbe88b9d6ff83d6e5de127078063cdf3a0d
Opcode Fuzzy Hash: 0d346e727850226258f51c974387f84fe26b6e1305cb1ebba1c01e11b764c5a6
Instruction Fuzzy Hash: 6E313C34E10229DBDB14DFA5D85479EF7B6EF85310F608526E806EB280EBB0E9C5CB54

Function 02C526EC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5494f937bc56536a606cb108b44da273b97070590bc898315ef429530f6c91b3
Instruction ID: a4aff10301d4aceff200ecc10507417774b168918279df79a4829c756c2fa0f1
Opcode Fuzzy Hash: 5494f937bc56536a606cb108b44da273b97070590bc898315ef429530f6c91b3
Instruction Fuzzy Hash: 09411FB1D00349DFDB10CFA9C880ADEBBF5EF48314F248029E819AB254DB75A985CF95

Function 02C5EF00 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6350f215143d1e508ae6aa0063230d97124ba3c8b89f82a0059ab46b10b9902b
Instruction ID: 324b433fbfa8b0e3a288e4b702387fef4c0b3a303b452fc2c4840ec7a74f4ede
Opcode Fuzzy Hash: 6350f215143d1e508ae6aa0063230d97124ba3c8b89f82a0059ab46b10b9902b
Instruction Fuzzy Hash: AC316D34A102298BDB19CF65C89469EB7F6BFC9300F108519E806EB390DB71ED81CB90

Function 02C526F8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0b4471655c06235150c5bf7d48f486abf86ac8a1358aff1658051b143f7bc9
Instruction ID: d92a3917decfd7af9389ce80b9db8b2f847134568881b05d68843b44cbd4d00d
Opcode Fuzzy Hash: 8e0b4471655c06235150c5bf7d48f486abf86ac8a1358aff1658051b143f7bc9
Instruction Fuzzy Hash: 5D41EEB1D00349DFDB10CFA9C980ADEBBF5EF48314F248029E819AB254DB75A985CB95

Function 02C550A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d7f2acfb8bd4babdfcd123e0e282f816addeba5526e2e9ad9849254f09d415
Instruction ID: f55dbaf59ba591650944bf56fc91d866a880bf7076aadb53e2a434db56259b2d
Opcode Fuzzy Hash: 99d7f2acfb8bd4babdfcd123e0e282f816addeba5526e2e9ad9849254f09d415
Instruction Fuzzy Hash: 1F314030A00225CFDB64EB35C9547AE77B6AF88384F500568D906AB364DF76ED81CB98

Function 02C550B8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a802b8827e6993c361cfb92fe9f8f9a95f47b0dcb7655541f6e108020642422
Instruction ID: 887bb753192e6baed005ae84c8e375a75bec3237a7d13e357d9d46388d478613
Opcode Fuzzy Hash: 6a802b8827e6993c361cfb92fe9f8f9a95f47b0dcb7655541f6e108020642422
Instruction Fuzzy Hash: DE314030B00225CFDB64EB75C9147AE77B6AF88384F500568D906AB364DF76DD81CB94

Function 02C58D48 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9081075999809ef515f7e20642cabc58244eb90a8798531f4e2cd4f8d5fff1e
Instruction ID: 9fbe4050a49bf98cc7b9a4370806a22f9cf3f78474d9ca9e2612dcec5f1a49b5
Opcode Fuzzy Hash: e9081075999809ef515f7e20642cabc58244eb90a8798531f4e2cd4f8d5fff1e
Instruction Fuzzy Hash: F3317375E002569BDB15CFA5D88079EF7B6BF85300F108619E805EB380DB70D9C2CB90

Function 02C58D58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393c546318b185f0dc73ad522ef3e1089b5ec0fed3d572dc9865a9b83372d9ef
Instruction ID: 161a9852e25be8eb84b219bea34fbbce61f7be732eb59d2bb2dd12011e043cdb
Opcode Fuzzy Hash: 393c546318b185f0dc73ad522ef3e1089b5ec0fed3d572dc9865a9b83372d9ef
Instruction Fuzzy Hash: 55215134E0026A9BDB15CF65D84479EF7B6FF85300F108619E805EB240DBB1D9C5CB90

Function 02C517D0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c58e9354049c71e91274565c5a81ff8acf798cb95da151df356d8fe8d7b66e
Instruction ID: 4dfe5583fdbfd337d06b8310e42aa86a80b52e56fbe5f452d61aa665158f1ee5
Opcode Fuzzy Hash: b4c58e9354049c71e91274565c5a81ff8acf798cb95da151df356d8fe8d7b66e
Instruction Fuzzy Hash: FC21C276A002258BDB20EB79E84875E7BA9EB84365F140525F909C7304EB78D951CB94

Function 02C51380 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f7f268c502236490587093087ea8b202ba8f68725d2fe71b124c8fd405d19b
Instruction ID: a3ce6f789fc97112e165fc6918778ac0e52276d67079b9f1737ed9e2756912f6
Opcode Fuzzy Hash: d2f7f268c502236490587093087ea8b202ba8f68725d2fe71b124c8fd405d19b
Instruction Fuzzy Hash: 5B21D1746002218FDF316668E08D32E3B65EBC2311F08196AE80ECB294DFB8D9C4CB46

Function 02C56B97 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f7850588c9941cbc60ee2a5e774983178dddbc51f287d18058e21ebfd0e5a9
Instruction ID: d5d9c4b59ddfc4d28a9e767ff1708cca29026b226493f523ead6d1ccc0fbea0c
Opcode Fuzzy Hash: 69f7850588c9941cbc60ee2a5e774983178dddbc51f287d18058e21ebfd0e5a9
Instruction Fuzzy Hash: F3213E723041659BD311EB79D42875E3BA6EF98300F1245AAD005CB3D8EF34D8428B80

Function 02C516B0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ffafb4b80cba273ccb76d51a6d238428adf6b2bb8310c2c2335eddd033e981a
Instruction ID: d7952274d01c3aec4ae1b611321b3b74f49fab6dc3921f9274421651764db00a
Opcode Fuzzy Hash: 3ffafb4b80cba273ccb76d51a6d238428adf6b2bb8310c2c2335eddd033e981a
Instruction Fuzzy Hash: 4321CB386001218FEF21E729E8887193B56E7D5304F045A29E50ECB255EF7CDD81CF95

Function 0145D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4572674438.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_145d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c756fae2737d76dc2f8728de1388be151e6d8dadfdbca1abe6d50a71b4762d
Instruction ID: 013099d687a611495127bce5cf274a11f65170fdf3ff45bb36d84ed1f13ea015
Opcode Fuzzy Hash: d9c756fae2737d76dc2f8728de1388be151e6d8dadfdbca1abe6d50a71b4762d
Instruction Fuzzy Hash: CD21FFB5A04200EFDB55DF54D980B26BBA1EF84B18F20C56EDD0A4B367C37AD407CA61

Function 02C58C49 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e363366fe86dd42afbf6a9f9d6c58e0cd92e84ef1f832cee6fbb5a5d40ea9e57
Instruction ID: fcb210ec1b677306fee29c1276de9740c9d0a78cca2c25f78e570dfbbc0ee861
Opcode Fuzzy Hash: e363366fe86dd42afbf6a9f9d6c58e0cd92e84ef1f832cee6fbb5a5d40ea9e57
Instruction Fuzzy Hash: 81219871E01626DBDB19CFA4C4506DEB7B2AF88310F50861AEC16F7350EB70E981CB50

Function 02C51898 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a456c7df35a15b9be578b4e0a4d0691a2be51cc3ca642110ded3856da622849
Instruction ID: a84f489b61b70dc8b6276c539633976bedc68183c852d02c6ef5d108c8ca6136
Opcode Fuzzy Hash: 3a456c7df35a15b9be578b4e0a4d0691a2be51cc3ca642110ded3856da622849
Instruction Fuzzy Hash: 5D212F30B00225CFDB64EB68C55879D77F6AF89244F140468C50AEB364DB75DD81CBA5

Function 02C58C58 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb965572b2046180c164f5c3357adcaf1e3c76340d39dfd17c02671bb88f7ecc
Instruction ID: f49154514d572be4fafafb022885054639e1d2bf18e8ca81ba4094adc6a4f110
Opcode Fuzzy Hash: bb965572b2046180c164f5c3357adcaf1e3c76340d39dfd17c02671bb88f7ecc
Instruction Fuzzy Hash: 71216530E0162A9BDB18CF65C4506DEB7B6AF89310F50861AEC16F7350EB70E981CB94

Function 02C51888 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de13f6413168654aff3b557314c558fde85d65ca33e87143201b5a7a91626ac
Instruction ID: 5637a1a0dd404c71cb868eebd0207633e0d9b6a0370b04cc89cc742f7bb0d871
Opcode Fuzzy Hash: 8de13f6413168654aff3b557314c558fde85d65ca33e87143201b5a7a91626ac
Instruction Fuzzy Hash: 94215E30B00265CFDB64EB64D55879E77F1AF89344F140468C90AEB360DB75DE81CBA5

Function 02C516C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fdf118e2dd7e3effe78ed5e7ef93312719067ccfff9006208feba6517d2d34
Instruction ID: ef85d962e663e924a5c999133016eb62adade08144e77fd4016e5031a992743d
Opcode Fuzzy Hash: 27fdf118e2dd7e3effe78ed5e7ef93312719067ccfff9006208feba6517d2d34
Instruction Fuzzy Hash: F921A4382401218FEF21E729E8887193B5AE7D0314F045A29E50ECB259EFBCD9818F94

Function 02C54FA8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b599f2db1ee6c1c3f9c0cf37262f3a4487129ee00ee0b1e72c5d80da21320b
Instruction ID: 3e7253ea53afb21d1594cf45a7103125533697b79e0ca7319c330ef9e067b269
Opcode Fuzzy Hash: 56b599f2db1ee6c1c3f9c0cf37262f3a4487129ee00ee0b1e72c5d80da21320b
Instruction Fuzzy Hash: 0D213630600224CFCB64EF78D558BAD77F1AF88348B1005A8E906EB364DB72DD40CBA5

Function 0145D005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4572674438.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_145d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbb2030f5fa4ff83c00c9efe3b5548374fa57f8b7dca0b328f8d3aad0c9abe5
Instruction ID: d77e4c8fadef3cbb55321f8c18aae4c26aa4a89509f0d9925f380fdb846f8c80
Opcode Fuzzy Hash: 1fbb2030f5fa4ff83c00c9efe3b5548374fa57f8b7dca0b328f8d3aad0c9abe5
Instruction Fuzzy Hash: 642183B55083849FDB02CF64D994716BF71EF46614F28C5DAD8498F2A7C33AD806CB62

Function 02C50848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d8492c03952a4a3a35a3efdd396dd2b9bc2f76e5cfc96bd92a24d0ffb8ae6e
Instruction ID: 44c514b99a9a3f4a70b7894a4b9c0bba2659e8ae27b59d2d28e2d6608d52336b
Opcode Fuzzy Hash: 74d8492c03952a4a3a35a3efdd396dd2b9bc2f76e5cfc96bd92a24d0ffb8ae6e
Instruction Fuzzy Hash: A0118F31B002298BEF245A7AC444B2A37A1FFC9714F244929D806CF296DF69C9C18FC5

Function 02C50838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf3a77afedeb8106a6611badac78f23765ab4b34f77dbe540b08474ce773623
Instruction ID: b90a484a43f8189375e5395a814ac5d6f5373716d13598c77974c715b12a8acb
Opcode Fuzzy Hash: 1bf3a77afedeb8106a6611badac78f23765ab4b34f77dbe540b08474ce773623
Instruction Fuzzy Hash: CB11A031B002298BEF245A658404B7A3790FFC9315F24493DD816CF285DB68C9C18FC9

Function 02C507F9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a653fe46cd03e0196dfb7ba8f1267a0a0e74b4b082e628f8005c948948c6bf5
Instruction ID: 00e92f611d48910d543948b20b276b1271e1be881c7c42e72d18fdb6a5b2101d
Opcode Fuzzy Hash: 8a653fe46cd03e0196dfb7ba8f1267a0a0e74b4b082e628f8005c948948c6bf5
Instruction Fuzzy Hash: A211C232A012348BEF256A69D450B693761FFC9318F28452AC806CF295EF79C9C5CFC9

Function 02C51498 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e3eeb3d8ec1d7e498acb70cee8e38294c703630df1ee56c52bc19ae42319c5
Instruction ID: fc80d18848c010296aae515f686dd4f8899913044b0ffeaf3871b7e757656768
Opcode Fuzzy Hash: 45e3eeb3d8ec1d7e498acb70cee8e38294c703630df1ee56c52bc19ae42319c5
Instruction Fuzzy Hash: 75117032A002259BCF21EFB988543AE77F6EF48314B595479DC0AE7201E771E981CB99

Function 02C514A8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074821e95040421fe46aac3612881fb3d4db0451507043b8572dd56d0dfa7412
Instruction ID: 4cb98f4bcb5ea92af7078af94de7f6039b0f03dcf5800eea3e6358e079f12de2
Opcode Fuzzy Hash: 074821e95040421fe46aac3612881fb3d4db0451507043b8572dd56d0dfa7412
Instruction Fuzzy Hash: 4F014032A012258FCF21EFB984542AD7BF6EF88314B54047ADC0AE7201E776D981CF99

Function 02C59388 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b45ceda748a6339e0b829358f36b8c9e0d3a4e9848bce63b36c16beabfff4d9
Instruction ID: 0623192396e76e46ec6dd0c462ec18a74da8bc52744bc1276d35aa068316572b
Opcode Fuzzy Hash: 3b45ceda748a6339e0b829358f36b8c9e0d3a4e9848bce63b36c16beabfff4d9
Instruction Fuzzy Hash: CA019230A001058BDB14DF55D84478ABB75FFC4310F548268C8086F29ADBB4EE45CBE0

Function 02C57BEA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cc34ccf35664c78590b0c733f749c4806514bb0390b3a7d7a89c3bef3818c2
Instruction ID: dc1a4424695a9ee44f9c0854651b77a3d238a00e9619bdcfebbce5ca52930d62
Opcode Fuzzy Hash: b1cc34ccf35664c78590b0c733f749c4806514bb0390b3a7d7a89c3bef3818c2
Instruction Fuzzy Hash: 42016D74A0125AEFDF05FFA5F88068DBBB1EB90300F50566DC508AB294EE756E048B81

Function 02C51534 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30aa5e4fdd63ce25f503dbab930cb74527b7f3a2ad6e61cf7290c3b347d5dac
Instruction ID: ce01efdbc9773af43386bddd0cae91494e22c93f3f349ee8ad8c110b179a5c5f
Opcode Fuzzy Hash: b30aa5e4fdd63ce25f503dbab930cb74527b7f3a2ad6e61cf7290c3b347d5dac
Instruction Fuzzy Hash: 89F0F637A04170CBCB12CBA594942AC7BB1EA9821179C10D7DD0BDB312D3B5E982CF59

Function 02C57BF8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4573124673.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c50000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa64aad5c0fd6b8765ecdb2ff51f32ab2bc272d1d55544d59fd54fa61e2a298
Instruction ID: 06519602bc90f13890dac40d4af2eef5ba5a57921c3fc03aea3f0121474914d6
Opcode Fuzzy Hash: 9aa64aad5c0fd6b8765ecdb2ff51f32ab2bc272d1d55544d59fd54fa61e2a298
Instruction Fuzzy Hash: D2F04F34A0115ADFDF05FFA9F88059DBBB1EB94300F50566DC508AB254EE756E049F81

Analysis Process: skyT.exePID: 1020, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	230
Total number of Limit Nodes:	15

Executed Functions

Function 06CE93F3 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CE962E

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 55cddab93e0425bdea83092a6ae344e8cd0df91316d2e1ad9c3da6e878b30a14
Instruction ID: 45376ef21d9f105d4a98d7869a637eab58aac05621f58c6d55b4fff7428801db
Opcode Fuzzy Hash: 55cddab93e0425bdea83092a6ae344e8cd0df91316d2e1ad9c3da6e878b30a14
Instruction Fuzzy Hash: FA915A71D01219DFEF60CF69C841BDEBBB2BF48314F1485AAE809A7240DB749A85CF91

Function 06CE93F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CE962E

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2fd12420c38f4250857d38a495806c4011d52262ae74bc14bb3a7dd935494d8d
Instruction ID: 1f994927ea33ef9b2c47cb8f3021fa92135fb300ba6d0f44eeabd3ab523683ee
Opcode Fuzzy Hash: 2fd12420c38f4250857d38a495806c4011d52262ae74bc14bb3a7dd935494d8d
Instruction Fuzzy Hash: C6915971D01219DFEF60CF69C841BEDBBB2BF48314F1485AAE809A7240DB749A85CF91

Function 026B5D1C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026B5DD9

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ecec17af0b2e7e5839da5f3b7c7a3820d6accbd9c78095599ed36b2a10a2756a
Instruction ID: 6867cf6d21bcd95ff7645f82bb83d40b426d6a719a237ae03e025aba2be53687
Opcode Fuzzy Hash: ecec17af0b2e7e5839da5f3b7c7a3820d6accbd9c78095599ed36b2a10a2756a
Instruction Fuzzy Hash: 614102B1C00719CBEB25CFA9C9847CEBBF2BF48704F60816AD409AB251DB756946CF90

Function 04D112A4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04D14381

Memory Dump Source

Source File: 00000009.00000002.2358965167.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d10000_skyT.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3db465dcb44d7ffe1d4e8c3299f3bfb9fe23e4b1811c977afb2d1170c5fb1b78
Instruction ID: 172db34e4496b0e7347051f5e4816065e2d5aa3369641b37c4a230b0ee7625b8
Opcode Fuzzy Hash: 3db465dcb44d7ffe1d4e8c3299f3bfb9fe23e4b1811c977afb2d1170c5fb1b78
Instruction Fuzzy Hash: D9411AB5A00305EFDB14CF99D488AAEFBF5FF88314F248459D519A7361D774A841CBA0

Function 026B4874 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026B5DD9

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c533d25bbd5f1e7bbb0759969c0de68279640fbbac0901aa78c12bcc3a4cb6bc
Instruction ID: 028a56d748e9857ea7cd19dd10ca84036a486aab712f6b7b29ce457152c385fd
Opcode Fuzzy Hash: c533d25bbd5f1e7bbb0759969c0de68279640fbbac0901aa78c12bcc3a4cb6bc
Instruction Fuzzy Hash: D141EFB0C00719CBEB25CFA9C9887CEBBB5BF48304F60816AD409AB251DB716946CF90

Function 06CE8D6B Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CE8E00

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 46413705c09e8cde4ef4a8d82e953620aa174416d8c62ceae2d2d06b6ae0abed
Instruction ID: 1587eec346a2056e2fbd51c29c59f2dc82eb43ff34daab10f7c66036eff072e4
Opcode Fuzzy Hash: 46413705c09e8cde4ef4a8d82e953620aa174416d8c62ceae2d2d06b6ae0abed
Instruction Fuzzy Hash: D32148B59013499FDB10CFA9C881BDEBBF5FF48314F108429E918A7240C7789950CBA5

Function 06CE8D70 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CE8E00

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d33f96ac228bdcece139735b24e0d75bf899dc94de26845171845b4977c88034
Instruction ID: f45233dabc9f3d45778e060f4d0a628456646cb9be6c115e1f4a5b68d9ae096e
Opcode Fuzzy Hash: d33f96ac228bdcece139735b24e0d75bf899dc94de26845171845b4977c88034
Instruction Fuzzy Hash: AB2126B59003499FDB10CFA9C881BDEBBF5FF48314F10842AE918A7241C7789950CBA5

Function 06CE8E5B Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CE8EE0

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f2f66c1c44d763e7289d68cbaa704e619e713eeb87d6a137f520e56c39eac32a
Instruction ID: d587ae0a53b323ba0ba2388d3ef0d475a42c16bee3f1f4da8d89d552210ab43c
Opcode Fuzzy Hash: f2f66c1c44d763e7289d68cbaa704e619e713eeb87d6a137f520e56c39eac32a
Instruction Fuzzy Hash: B32116B58013499FDB10DFAAC881BDEFBF5FF48324F108429E519A7240CB799950CBA5

Function 06CE8BD3 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CE8C56

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3cae69708e2e5d6b38036407267adc2794553e3408e305a6615a41a7d9495abc
Instruction ID: c68a2b6db9892237c1f2ca316599aee1ee638091893ee3b37abbdfca1f17c3b4
Opcode Fuzzy Hash: 3cae69708e2e5d6b38036407267adc2794553e3408e305a6615a41a7d9495abc
Instruction Fuzzy Hash: DD213775D013099FDB10DFAAC885BEEBBF4AF88224F148429D519A7240CB789945CBA5

Function 026BD030 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,026BD6AE,?,?,?,?,?), ref: 026BD76F

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e0a2ebe24dd0615b119b0d3a23f8f3099928878bcd30c0791aab550dd3e1420b
Instruction ID: dd6dafc3ade02364842d0a2ed961ca10352f772fa93f93b67407cbfa5904dc02
Opcode Fuzzy Hash: e0a2ebe24dd0615b119b0d3a23f8f3099928878bcd30c0791aab550dd3e1420b
Instruction Fuzzy Hash: ED21D4B5900249AFDB10CF9AD984ADEFBF4EF48324F14841AE914A7310D375A950CFA5

Function 06CE8E60 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CE8EE0

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6dcd37fbc93830568846e481a4942e7b9ef6c74c3bb9428c5da32451e3773509
Instruction ID: 18f749155dfaddf62f67122fc848db186c6dba1c07d9962b4cb5ef994cde37d2
Opcode Fuzzy Hash: 6dcd37fbc93830568846e481a4942e7b9ef6c74c3bb9428c5da32451e3773509
Instruction Fuzzy Hash: C42114B18003499FDB10CFAAC881AEEFBF5FF48320F10842AE518A7240C7799950CBA5

Function 06CE8BD8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CE8C56

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 66863a1662f31fc2f212aedec1d0c003c9bb2accc88b59bd6ecbd11405cea797
Instruction ID: 0892f7aa627135afdd62636c7622f4ada00741dcff7a0e27cf9b5bbec1316631
Opcode Fuzzy Hash: 66863a1662f31fc2f212aedec1d0c003c9bb2accc88b59bd6ecbd11405cea797
Instruction Fuzzy Hash: 00213571D003098FDB10DFAAC8857AEBBF4EF88324F14842AD519A7240CB78A945CFA5

Function 026BD6E7 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,026BD6AE,?,?,?,?,?), ref: 026BD76F

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ac32193c217e43fa126f7fb84cdef60a7c8f55137157c78d996019c45106c807
Instruction ID: 896cfd74ec162a103a55f20f52eaf96bcc2a6d4f1fdcff51eab4f6393bd92c1a
Opcode Fuzzy Hash: ac32193c217e43fa126f7fb84cdef60a7c8f55137157c78d996019c45106c807
Instruction Fuzzy Hash: 0C21D2B5900249AFDB10CF9AD984ADEBBF4EB48324F14841AE918A7310D375A950CFA1

Function 06CE8CAB Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CE8D1E

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dfd6ac9cff995685900b13058d6be5c76e55e9cd9b021b1648f588e7d71a333d
Instruction ID: 89a228af0e16229a61a4927574ebf125290f2dc14c243b25695a4516c8651aa4
Opcode Fuzzy Hash: dfd6ac9cff995685900b13058d6be5c76e55e9cd9b021b1648f588e7d71a333d
Instruction Fuzzy Hash: 721159758003499FDB10CFAAD845BDFBBF5AF88324F108419E515A7250CB799550CBA1

Function 026BAC10 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,026BB4D9,00000800,00000000,00000000), ref: 026BB6EA

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 34b5cc75582a5dc8af633ad664c28be09218e6b0f7045199b3faf86c7e5f7db4
Instruction ID: 3c9e74852f01adf6b6a278df58f4892371788420c0b73c8160d244e5696e7bae
Opcode Fuzzy Hash: 34b5cc75582a5dc8af633ad664c28be09218e6b0f7045199b3faf86c7e5f7db4
Instruction Fuzzy Hash: BE1106B69003499FDB10CF9AC944ADEFBF4AF48324F10842AD915A7200D3B5A945CFA5

Function 06CE8CB0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CE8D1E

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed380f31a8942a62a5164006d11aacc3822c516a457de1d4d4f5bb996e8d8767
Instruction ID: 9007545ee2b3d0d2f8e161cb14ea1877f1b1431d72ddd8003d45920f10723a99
Opcode Fuzzy Hash: ed380f31a8942a62a5164006d11aacc3822c516a457de1d4d4f5bb996e8d8767
Instruction Fuzzy Hash: 5E1156768003499FDB10CFAAC844BDEBBF5AF88324F10841AE519A7250C775A950CBA1

Function 06CE8B23 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CE8B8A

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b391a528a82ae70a646ed5d74e9c14a686cfe9446e7bc383e6628bf11aed6713
Instruction ID: 8282b899e6cebb7bd8134af87e5dbe5c83f8b0224ec6bd951643040919285d98
Opcode Fuzzy Hash: b391a528a82ae70a646ed5d74e9c14a686cfe9446e7bc383e6628bf11aed6713
Instruction Fuzzy Hash: DA1158B1D003498FDB20DFAAC845BDFFBF4AF88624F248419D519A7240CB79A544CBA5

Function 026BB67F Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,026BB4D9,00000800,00000000,00000000), ref: 026BB6EA

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7400e0008eb67ed27c8d4739835c694800a3ce0b62782af05bee4e35e5bdaa37
Instruction ID: 65929e8471bbb468bcfe032cbe6b49b02ed8d76d056415afe07118a2e7f56aeb
Opcode Fuzzy Hash: 7400e0008eb67ed27c8d4739835c694800a3ce0b62782af05bee4e35e5bdaa37
Instruction Fuzzy Hash: C011E4B69002499FDB10CF9AD944ADEFBF4AF48324F10842AD919A7200D375A545CFA5

Function 06CE93DC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06CECE39,?,?), ref: 06CECFE0

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f00a1f751c452b9a7315c3095eb8d6f740b48d7d922e3154014054fa89c7361a
Instruction ID: 0aa29d37b3a7c9c20acd49720b24bc807991cdebec658b983626b6994b97cddf
Opcode Fuzzy Hash: f00a1f751c452b9a7315c3095eb8d6f740b48d7d922e3154014054fa89c7361a
Instruction Fuzzy Hash: 331125B5804349DFDB50DF9AC445BEEBBF4EB48324F208419E968A7340D778A944CFA5

Function 06CECF80 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06CECE39,?,?), ref: 06CECFE0

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: deb1f1d948f074beda401d66ef6e126c07afb275da4b8df3f68e934538b91428
Instruction ID: fa3a7f47d820a677d71e9bf13ddc09b844ec1aabe84dee53099432d0a22d6aaa
Opcode Fuzzy Hash: deb1f1d948f074beda401d66ef6e126c07afb275da4b8df3f68e934538b91428
Instruction Fuzzy Hash: F31155B58002898FDB10CF99C445BEEBBF4FF48324F20841AD968A7340D778A644CFA5

Function 06CE8B28 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CE8B8A

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 07c0f8bf4e07d707bb1d1cb709e0d157bbb522c8eecb0e9aebf96e92b8165371
Instruction ID: c8e3c8096e1eff79b20065c4c9187067bbc72d5d21dbfc74f9acc63276d9df2d
Opcode Fuzzy Hash: 07c0f8bf4e07d707bb1d1cb709e0d157bbb522c8eecb0e9aebf96e92b8165371
Instruction Fuzzy Hash: 6A1106B1D003498FDB20DFAAC84579EFBF5AF88724F248419D519A7240CB79A944CBA5

Function 026BB3F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026BB45E

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d6457c33f93d40a3afa38fb938887f4317bad87652fca6904b796004f212999a
Instruction ID: 311934d4b3efe9446175a113b5c26907dee63beaff7eebcf7217427f1901f382
Opcode Fuzzy Hash: d6457c33f93d40a3afa38fb938887f4317bad87652fca6904b796004f212999a
Instruction Fuzzy Hash: 4111DFB6C007498FDB10CF9AC544ADEFBF4BF88628F10845AD829A7314D3B9A545CFA5

Function 026BB3F7 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026BB45E

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 400b0d40944463d31032e1d28f96157d4373fccbb3284042fd9856585ab523f9
Instruction ID: a837fbb8c63be7f3a94430c28d7daefaa4f5c9cb935b22de250a656ca148b98c
Opcode Fuzzy Hash: 400b0d40944463d31032e1d28f96157d4373fccbb3284042fd9856585ab523f9
Instruction Fuzzy Hash: F011DFB6C006498FDB10CF9AD544ADEFBF4FF88628F10845AD829A7314D3B9A545CFA1

Function 026BB721 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,026BB4D9,00000800,00000000,00000000), ref: 026BB6EA

Memory Dump Source

Source File: 00000009.00000002.2352619865.00000000026B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26b0000_skyT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 80c937b888744085fdd63e6dbec969e522016baadccac163b2468bee3c8938e7
Instruction ID: 0862cb0eae41f37688e6e26bdda043321c4734c240edebbd1e50174335fd7d11
Opcode Fuzzy Hash: 80c937b888744085fdd63e6dbec969e522016baadccac163b2468bee3c8938e7
Instruction Fuzzy Hash: 4B01A7B69003088FDB118FADDC047DABFF4AF95328F10816AE548D7760C3B59885CB65

Function 06CE9078 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CEBDFD

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3c3a41f6b0ef572110f347dc2e1deda98cd9649b2daeb15ba98540c0bd97a73f
Instruction ID: 0c83d4f3815e55981a4d5847dbfe198e67e801e523013a4d9990ca13544d9747
Opcode Fuzzy Hash: 3c3a41f6b0ef572110f347dc2e1deda98cd9649b2daeb15ba98540c0bd97a73f
Instruction Fuzzy Hash: 3A1122B58003499FDB50CF8AC944BEEFBF8EB48324F208459E518A3200C3B5AA50CFA5

Function 06CEBD98 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CEBDFD

Memory Dump Source

Source File: 00000009.00000002.2359809125.0000000006CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ce0000_skyT.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3bd16480cd1cdd90b56acca331806ee29c6127f183f879491256b0beaeefbc6e
Instruction ID: 2111829638d8821ac58b1b9593a65d1550ee24892a17e0385f469adda366e7f2
Opcode Fuzzy Hash: 3bd16480cd1cdd90b56acca331806ee29c6127f183f879491256b0beaeefbc6e
Instruction Fuzzy Hash: 5211E0B98006499FDB10DF9AC945BDEFBF8FB48324F20845AD958A7200C375A984CFA1

Function 00A8D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2351780110.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a8d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19adafc3118b945a8011280af969782acb892a6fc136d17b8d286c9c76edab79
Instruction ID: 0af947e340bd7fa7f4047099f1ab8bee3d4c70a18b2b60ec81beb6d59a5dbf0c
Opcode Fuzzy Hash: 19adafc3118b945a8011280af969782acb892a6fc136d17b8d286c9c76edab79
Instruction Fuzzy Hash: BA21F5B2504244EFDB19EF14D9C0F26BF65FB88718F24C56EE9090B296C336D856CBA1

Function 00A9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2351822617.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a9d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04889e3ad0f3c22568520507a110be1f12179d71cb8589e8648307d2b3186f5
Instruction ID: e5052fe40a1d0443de1b9aec9dde7eb6776aac6d9e8398fd1435c620f6b4c3f6
Opcode Fuzzy Hash: c04889e3ad0f3c22568520507a110be1f12179d71cb8589e8648307d2b3186f5
Instruction Fuzzy Hash: 2A210E75604200EFDF14DF24D980B26BBA1FB88314F20C56DE90A0B296C77AD886CA61

Function 00A9D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2351822617.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a9d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a987343e0a62bddce889db0ea399b1a9ba7f81d57f8a4ace090c901fcf6e01
Instruction ID: f3171d745f31d41ac004cf53b3fc00b89167ccb89f4925a2428aed06b607ce17
Opcode Fuzzy Hash: 31a987343e0a62bddce889db0ea399b1a9ba7f81d57f8a4ace090c901fcf6e01
Instruction Fuzzy Hash: 0121C6755093808FDB02CF20D590715BFB1FB45314F28C5DAD8498B2A7C33AD84ACB62

Function 00A8D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2351780110.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a8d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 3299495cac5a62e76a09f58dabada7c0146afbe17a0d96de956ae23bf976f7ca
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 4C11E676504280DFCB15DF10D5C4B16BF71FB94318F24C6AAD8490B656C33AD856CBA1

Function 00A8D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2351780110.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a8d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403b9a74bcd16bd28731a66577adf3d251e4225f55c625072aa0c9e41d98d218
Instruction ID: 345246b37eefbfe7d639a2bbf761dbb4deb684549544cf1cd4e2dd99bbee8a35
Opcode Fuzzy Hash: 403b9a74bcd16bd28731a66577adf3d251e4225f55c625072aa0c9e41d98d218
Instruction Fuzzy Hash: DE012671004340DAE7206B25CD80B26FFE8EF51334F18C41AEE080A2C6C7B89840C7B2

Function 00A8D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2351780110.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a8d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a857f3dfd910273a7eb2d5b427af62a4eeb7f0ffc78f21a870e49f2a187bf3
Instruction ID: 0ee8fb86279b668c4472b397f1fddb793ed9a4a3d743ce9ff2368364f6f45da6
Opcode Fuzzy Hash: 03a857f3dfd910273a7eb2d5b427af62a4eeb7f0ffc78f21a870e49f2a187bf3
Instruction Fuzzy Hash: 73F06D72405344AEE7209B16DD84B62FFA8EF91738F18C45AED084A286C379A844CBB1

Analysis Process: skyT.exePID: 1656, Parent PID: 1020COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	94.4%
Signature Coverage:	0%
Total number of Nodes:	250
Total number of Limit Nodes:	23

Executed Functions

Function 017E9628 Relevance: 2.9, Instructions: 2889COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9010b1d1cc66e2240b3a2047141fd0694244138ac00f15d5b85c39d4f68a2949
Instruction ID: e474cba1123184b3502ddaf30217b0aff1aa9f32a9d469a8f95f28949ffce999
Opcode Fuzzy Hash: 9010b1d1cc66e2240b3a2047141fd0694244138ac00f15d5b85c39d4f68a2949
Instruction Fuzzy Hash: EE63E731D10B1A8ADB11EF68C884A99F7B1FF99310F15D79AE44877121EB70AAC4CF81

Function 017ECAE8 Relevance: 2.3, Instructions: 2293COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3925dfcc6cb81b0e21b8c0b8040194a09d3f428d9915754db634e930508fc43
Instruction ID: 716684b3dcf0cb8f60f84d4ac966d7ad04c4428d3f6d78bb2ee1f6b96ff14fc7
Opcode Fuzzy Hash: b3925dfcc6cb81b0e21b8c0b8040194a09d3f428d9915754db634e930508fc43
Instruction Fuzzy Hash: 7A330D31D10B198EDB11EF68C8846ADF7F1FF99300F15C69AE458A7215EB70AAC5CB81

Function 017E4AA8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac38f659c577fbd1d6f8049bc3c905e297c33f709c9874d61df54010ea4740b
Instruction ID: 1882d13aa8b2b0d5702bb1972b6585f7a6bcb02afd152283d4a3b37c5ca40cac
Opcode Fuzzy Hash: 4ac38f659c577fbd1d6f8049bc3c905e297c33f709c9874d61df54010ea4740b
Instruction Fuzzy Hash: 62B15B70E002098FDF10CFA9C88979DFBF2AF88714F148529D916EB294EB759891CB81

Function 017E3E90 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32f5b37b5ce25cb42d0ca0d3a04f692a92d92120c6ca393a8c6172ddc7149ac
Instruction ID: f98a6fec4ab8d347557f531697d4e60ed12f60cf5da62789bc25bb9210c05d20
Opcode Fuzzy Hash: a32f5b37b5ce25cb42d0ca0d3a04f692a92d92120c6ca393a8c6172ddc7149ac
Instruction Fuzzy Hash: 1C914870E002499FEF10CFA9C9897AEFBF2BF88714F148129E415E7294EB749845CB81

Function 0664796F Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06647936

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 671ab2654c932d217dfb333a3ac445759b43cc21d903d9b6f292b77db91b9ab9
Instruction ID: 7fa869c9fcc4a82fc919a87501312865135d88aea55dcd95795102b334ecdc1a
Opcode Fuzzy Hash: 671ab2654c932d217dfb333a3ac445759b43cc21d903d9b6f292b77db91b9ab9
Instruction Fuzzy Hash: 634142B1D002898FDB54EFA9C844B9EBFF1BF48314F20852AE819A7340D7759585CF95

Function 06648973 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06648A8A

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f7ad99f75c031fbb50c8cfe4bf2b3fe5aeb0ed2f36a8f59a6ed7b578b794612b
Instruction ID: a7c734d69eb00869302b45453dcbd9db827f0cb88bf17898983869bc9e73a36f
Opcode Fuzzy Hash: f7ad99f75c031fbb50c8cfe4bf2b3fe5aeb0ed2f36a8f59a6ed7b578b794612b
Instruction Fuzzy Hash: 6C51B0B1D003499FDB14CF99C984ADEBBB1BF48310F24822EE819AB250D7B19985CF90

Function 06648978 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06648A8A

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 97bab5b22186ecbb9e0d52efe4506f38d7634831139a06e3fc5afe29f981e130
Instruction ID: af3139d5990fca97f4e47ab44414773b7e9be45269b62c0fe83e26a8c3f4da1a
Opcode Fuzzy Hash: 97bab5b22186ecbb9e0d52efe4506f38d7634831139a06e3fc5afe29f981e130
Instruction Fuzzy Hash: 5941B0B1D00349DFDB14DF9AC984ADEFBB5BF48310F24812AE819AB250D7B59885CF90

Function 0664C28C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0664D631

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cb4e399d5011a368f9c671a8dbad589576f99a9e36be77e42e589ec447e3374c
Instruction ID: 9a1dcc58504ddd8c31f3fcf3c1c438c38206d40ce6cfc12ccdd531ef36804dfa
Opcode Fuzzy Hash: cb4e399d5011a368f9c671a8dbad589576f99a9e36be77e42e589ec447e3374c
Instruction Fuzzy Hash: 014136B4D00309CFDB54DF99C888AAABBF5FF88314F248459E518AB321D774A941CFA0

Function 0664E2AC Relevance: 1.6, APIs: 1, Instructions: 79
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0664E340

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: cea62e2edfb0b722cea8af564a18c51d8b7097950f5321dc72e06c5ba029a8f9
Instruction ID: 0241a838e969b0b1655d059939bc230c8b836b19e744d66143afaf0be5b9f115
Opcode Fuzzy Hash: cea62e2edfb0b722cea8af564a18c51d8b7097950f5321dc72e06c5ba029a8f9
Instruction Fuzzy Hash: 913110B0D01208DFDB55DFA9C984B8EBBF5BF48714F248019E004BB3A0DBB5A845CBA5

Function 0664DCA8 Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0664E340

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 02e401348c29cf73e590f334949da8a701fb6956eff169227978b6eef6f86eae
Instruction ID: e7c892730046cc848048a8db77c05b459c3fe7c929f69f53354e637063829b7b
Opcode Fuzzy Hash: 02e401348c29cf73e590f334949da8a701fb6956eff169227978b6eef6f86eae
Instruction Fuzzy Hash: 36311FB0D01208DFEB51DF99C984B9EBBF1BF48714F248059E404BB3A0DBB5A845CB91

Function 0664C6D0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0664C75F

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 821abfb45596b73419af19cb12a3bfa10ce8b66a1f50469154d48de33bbfe58a
Instruction ID: 0eb991e0211db1192c1c7c647c0b7360353305e11ea1df9ff1ab9703d53aaab5
Opcode Fuzzy Hash: 821abfb45596b73419af19cb12a3bfa10ce8b66a1f50469154d48de33bbfe58a
Instruction Fuzzy Hash: 2221E3B59012499FDB10CFA9D984AEEBFF5EB48320F24841AE918A3350D379A950CF64

Function 0664C6D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0664C75F

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4b58a0d08644f5401d0f1963253af4c59b6a16a2133db6735473d1559a4982f5
Instruction ID: 21b54e6e099b46721c480513e3906f19d3252ec3997c08311b7e7e107a2c3061
Opcode Fuzzy Hash: 4b58a0d08644f5401d0f1963253af4c59b6a16a2133db6735473d1559a4982f5
Instruction Fuzzy Hash: 9121E4B59012499FDB10CFAAD984ADEFBF4FB48720F24801AE914A3310D374A950CFA4

Function 0664FE01 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0664FE83

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 53674fc3a856abb27f19cccae931aec230703b10b25091984976854c20943d73
Instruction ID: 362f3fa9c95edca0ebe21af8c3315ae22bc715c8ff6ea085aa17416dfa6a65c6
Opcode Fuzzy Hash: 53674fc3a856abb27f19cccae931aec230703b10b25091984976854c20943d73
Instruction Fuzzy Hash: D62115B5D002499FDB54DFAAC944BDEFBF5AB88720F108429E419A7250CB75A940CFA1

Function 0664FE08 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0664FE83

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 47def53e13bfed4e2fa937c93d79f5e552962a7ba8aff21906b08c81cfebdf80
Instruction ID: a07bf574d7e797bb9736435ed99f3c0b720ef2b16812ed577a42ed0a284f8f11
Opcode Fuzzy Hash: 47def53e13bfed4e2fa937c93d79f5e552962a7ba8aff21906b08c81cfebdf80
Instruction Fuzzy Hash: E82115B1D002499FDB54DF9AC944BDEFBF5AB88720F108429D418A7250CB75A940CFA1

Function 06645E44 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06647936

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e145d81873c2040551fee43828073be5b76a32b60016378cad468b21d8d21c5c
Instruction ID: 2dbdf6cb58356c2ffe2bac6c814fdbeeb27b7df88f05ed43b2f3b2655b5197fc
Opcode Fuzzy Hash: e145d81873c2040551fee43828073be5b76a32b60016378cad468b21d8d21c5c
Instruction Fuzzy Hash: 8A1120B5C003498FDB10DF9AC844B9EFBF4EB88220F10846AD818B7700C3B5A505CFA4

Function 066478CD Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06647936

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 61d8e8114f117dbd3a22c5c119dc7589adf7f67770b34a9b0af59e25335b6a4f
Instruction ID: a1c2db6fdbf615acd0b3eff420ceebdbaa8bc9325258e34fb0c2b94528ff7d85
Opcode Fuzzy Hash: 61d8e8114f117dbd3a22c5c119dc7589adf7f67770b34a9b0af59e25335b6a4f
Instruction Fuzzy Hash: 0F1102B5C002498FDB10DF9AC944A9EFBF4AB88620F10842AD419B7710D375A545CFA5

Function 0664C2E4 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0664D87D), ref: 0664D907

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b4f97623d698e000fea9790bdcd8b8ea97b67132260878e2992b9c16100e997f
Instruction ID: 44a342b5100f0b3499b5b4de14721bce776b4810bded102297a6f89ef34fe8f0
Opcode Fuzzy Hash: b4f97623d698e000fea9790bdcd8b8ea97b67132260878e2992b9c16100e997f
Instruction Fuzzy Hash: 361122B18002498FDB50DF9AD584B9EBBF4EF48220F20846AD518A3350D3B5A940CFA4

Function 0664E169 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0664E1C5

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fb227d4061d40790218ef7316b56b7a3f1c071919ff0f7bbfb65873012e302af
Instruction ID: 1245ee02dca2487bd03dd720b2542f263cdda12e96ce05e0700dd5e69effbc58
Opcode Fuzzy Hash: fb227d4061d40790218ef7316b56b7a3f1c071919ff0f7bbfb65873012e302af
Instruction Fuzzy Hash: 3A1103B58003898FCB60DFAAD944BCEFFF4EB48224F248859E559A7700C775A544CFA5

Function 0664DB90 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0664E1C5

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1551bd8b124d6ac0672a4704e4806bf10b51da2d50767dd69de9eb9affc9a7c0
Instruction ID: 795364537ab1185f112ab52a5db063b8357aa09c1ff7549850e86e20dc57410b
Opcode Fuzzy Hash: 1551bd8b124d6ac0672a4704e4806bf10b51da2d50767dd69de9eb9affc9a7c0
Instruction Fuzzy Hash: DE1103B5900349CFDB50DFAAC544B9EBBF4EB48324F208459E519A7700D3B5A944CFA5

Function 0664D8A0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0664D87D), ref: 0664D907

Memory Dump Source

Source File: 0000000A.00000002.4578410358.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6640000_skyT.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0bf027f135b8720a3d8d17af07af45e2546011e542e844cff4a3abaaf0e2133b
Instruction ID: 658eb74df94f5a9ab44dd2528004bf43497656e818a36da76e09803a024ed2c6
Opcode Fuzzy Hash: 0bf027f135b8720a3d8d17af07af45e2546011e542e844cff4a3abaaf0e2133b
Instruction Fuzzy Hash: 5E1103B5C002498FDB20DF9AD944BDEFBF8AF48724F20845AD518A7350C7B5A944CFA5

Function 017E8E5C Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bccd5e7574f854aa46e0afee4feb718c95597bdf82623da661bec251a31c5a35
Instruction ID: 9b43b99cb3a4cf1c248e25995f6d129f0d18797457bae395baa3ba6173ca454d
Opcode Fuzzy Hash: bccd5e7574f854aa46e0afee4feb718c95597bdf82623da661bec251a31c5a35
Instruction Fuzzy Hash: 2CD18E35B00205DFDB15DBA8D488AADBBF2FF88324F148469EA06EB355DA35DC41CB91

Function 017E7780 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9fc1b23f37231bb6adcfe58d1c34c52e2bb858fb6a721f01c295f1ad134bc4
Instruction ID: 6c8d7f7fb42d298154c0256ba8e9e55fb6b1b0b69dd8cb0b0461c693a99a97cd
Opcode Fuzzy Hash: 9c9fc1b23f37231bb6adcfe58d1c34c52e2bb858fb6a721f01c295f1ad134bc4
Instruction Fuzzy Hash: B0B19F30700203DBDB2A9B2CE4896197BA2FBC9365F50993DE106CB355CE7AEC46D791

Function 017E4A9C Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f8a7a0ee76748e12593a1dd6df0c794025c2cada182782791849687556e8c1
Instruction ID: bfa156b10d25272c7b173b4e39bd539b190f959680beb44df51267b9e88fbdcd
Opcode Fuzzy Hash: 83f8a7a0ee76748e12593a1dd6df0c794025c2cada182782791849687556e8c1
Instruction Fuzzy Hash: 50B14A70E002598FDF10CFA9C88979DFBF1BF48714F248129D916EB294EB759895CB81

Function 017E3E88 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f40bc0e8c7c9cd1a3c42a3570931b0ceab85e06a47dc25d2c64ca55d011b94
Instruction ID: 8f91e552ed8290fa49800a3e2269a3c0ce47903fad1f9362b18f0a8972704ca3
Opcode Fuzzy Hash: 98f40bc0e8c7c9cd1a3c42a3570931b0ceab85e06a47dc25d2c64ca55d011b94
Instruction Fuzzy Hash: 7C912770E002499FDF10CFA9C9897AEFBF1BF88714F248129E415E7294EB749945CB91

Function 017E9388 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e6b28f8335bfbd0d49934bc5f835541234f84a0d19cfcf341fcb8d67ad8c65
Instruction ID: 14f215cddda844f5cffa64470a8cfb961389be42d2be809d05caf1b22414b78c
Opcode Fuzzy Hash: a4e6b28f8335bfbd0d49934bc5f835541234f84a0d19cfcf341fcb8d67ad8c65
Instruction Fuzzy Hash: 3F818F71A002059FDB14DF69D888B9EFBF1FF88314F24C169EA09AB395DB719841CB90

Function 017EC868 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a338779520933ecb07a02755b97a1cd34f46571b3778f07619875c37d76466
Instruction ID: a8881560db917fcbe76ffdbe5d02e361180c17444f43a875e1f3e961d6f38404
Opcode Fuzzy Hash: a1a338779520933ecb07a02755b97a1cd34f46571b3778f07619875c37d76466
Instruction Fuzzy Hash: 5361D536E1056A8FDB16CB5CC9946BDF7F2EF88310F19896AC456AB242C334AD45C790

Function 017E4820 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12146314363ce4bc7b0212a0625f8ef22881540ac150d1c5d9a509e9a84d2cd3
Instruction ID: 343ed3fa106ebfef41e8ac5885fab01d8a117f845c40ae7c8834c8d59868bfc8
Opcode Fuzzy Hash: 12146314363ce4bc7b0212a0625f8ef22881540ac150d1c5d9a509e9a84d2cd3
Instruction Fuzzy Hash: 557157B1E002499FDF10CFA9C88879EFBF2AF88714F148129E416E7254EB749942CB95

Function 017E4814 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ea9ce375806452e0acbfdd8fa051882d120c0e9fb923caf7e3744807174bfe
Instruction ID: 68aad202aeab8e4807bad28b3bc76cbcfad27a93b1fa07f15247800bfa9bdc6a
Opcode Fuzzy Hash: e6ea9ce375806452e0acbfdd8fa051882d120c0e9fb923caf7e3744807174bfe
Instruction Fuzzy Hash: 247156B1E002499FDF10CFA8C88979EFBF2AF88714F148129E416E7254EB749942CB95

Function 017EF02D Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122ff42eb206d07ef34441986b194e2c6ea0d99892df12cfbd6012acccda31be
Instruction ID: 61b4ac5932fe332fd3f822a1557148ff0089852c123e4b8b851cd15169de5ca0
Opcode Fuzzy Hash: 122ff42eb206d07ef34441986b194e2c6ea0d99892df12cfbd6012acccda31be
Instruction Fuzzy Hash: D841C030B0020A8FDB199B38D858A6EBBF2AF8D744F24846DD406DB385EE35DC46C790

Function 017E91D8 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5faf8774f3197a1b7b88d03734c67c870a54180ac4d6fc73b9c33694ba98e1e2
Instruction ID: 7801e7b0008d82197c20fca8e6321174add2134c9caa9080f613bf0dd8305991
Opcode Fuzzy Hash: 5faf8774f3197a1b7b88d03734c67c870a54180ac4d6fc73b9c33694ba98e1e2
Instruction Fuzzy Hash: 6441B932B052469BDF318AACD48876FF7F5FB89214F20482AD61ADB395D634DC418791

Function 017E6CEB Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74dac53489ab5da8415126d7de54f7f6026225bc966e1b6ab81fe8f51bbe13e
Instruction ID: c470d2e69c2521cca19211662ef0e6609dabf334a0406b6a3edfebfa459f6e03
Opcode Fuzzy Hash: e74dac53489ab5da8415126d7de54f7f6026225bc966e1b6ab81fe8f51bbe13e
Instruction Fuzzy Hash: EB5103B0D002188FDF14CFA9C849B9DFBF1BF48314F148129E815AB391D7B4A884CB95

Function 017E6CF0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea7ebe537b0fa55cd5ddc212267ca46159f058d9071eb99d12a4fe7f26e0e6a
Instruction ID: 88874024f640698d23321b0e205dfa890cbee32f35ddf14e4a122abb7b773e0d
Opcode Fuzzy Hash: 9ea7ebe537b0fa55cd5ddc212267ca46159f058d9071eb99d12a4fe7f26e0e6a
Instruction Fuzzy Hash: 5D51F3B4D102588FDF14CFA9D848B9DFBF1BF48314F548129E815AB391D7B4A884CB95

Function 017E1128 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9759e8feff62d6dac0c9451d1c66085d28871fbe738d3f2a0839087801d177
Instruction ID: fa9d8d18cb05e245ec89604e7f8cd95de664d3444057bb129e885c44a738990b
Opcode Fuzzy Hash: 5d9759e8feff62d6dac0c9451d1c66085d28871fbe738d3f2a0839087801d177
Instruction Fuzzy Hash: 4951F870305242EFC73ADF2CFE889567FA1EB96305300B5ADD2045B266DA7E2D15CBA1

Function 017E17D0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a95259cf5a395abb128d3c98e7ff43ea523a26340d34e04e52104fa7ddb953
Instruction ID: 92483e723e221c210382c8a9f4549620ff39c066f620f1dd6aa360d5c94ecaed
Opcode Fuzzy Hash: 88a95259cf5a395abb128d3c98e7ff43ea523a26340d34e04e52104fa7ddb953
Instruction Fuzzy Hash: 4841E370B40202DBDB21DB3CE98D65EBBE6EB8C754F501529E90AC7245EB3DDD018B91

Function 017E71E8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9013325def1b714d89697a683fbfed531a1a12d546185b25964581372a03526b
Instruction ID: 5c6e3c97801a5d03ca8ba6b3a0cfdd5ea9b233fe3244fb1dfab0dc6beb1c71b1
Opcode Fuzzy Hash: 9013325def1b714d89697a683fbfed531a1a12d546185b25964581372a03526b
Instruction Fuzzy Hash: 7C41A230E0424ADBDB19DBA8D44879EF7F6FF89314F208569E801EB245EB759842CB80

Function 017E1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5feac80d8e823b4d6c51f6a67d3dea285b7e89ab2c9d3d2c419c364d36213a38
Instruction ID: 1c6b1398f8ecfa54cbb754ebcaf25e83f967537e68bb092164ab74fb3abf0504
Opcode Fuzzy Hash: 5feac80d8e823b4d6c51f6a67d3dea285b7e89ab2c9d3d2c419c364d36213a38
Instruction Fuzzy Hash: 5F51D770305142EFC73ADF2CFE889567FA1EB95306300B5A9D2085B266DE7E2D15CBA1

Function 017E4F98 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c357bd3eddf44c96577d3d00994f34489b353fc140679d31b6dacdb7bf29c2
Instruction ID: 3d19fa3988384ab989a16582ccc887a130a924cde0808246818daf85c7e774e2
Opcode Fuzzy Hash: c5c357bd3eddf44c96577d3d00994f34489b353fc140679d31b6dacdb7bf29c2
Instruction Fuzzy Hash: 79416B35600249CFDB25DB78C918B9EBBF1EF89218F2444A9E506DB361DA369C01CB91

Function 017E71F8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a068304513b86d7789a5b96030ac2237dc6f63813fa0d7c7d0a54e7aac05b97f
Instruction ID: 032a30f6903a09735c0c628befaa971375e0e757192f62e2b2b3ab5e46e569d5
Opcode Fuzzy Hash: a068304513b86d7789a5b96030ac2237dc6f63813fa0d7c7d0a54e7aac05b97f
Instruction Fuzzy Hash: CC316030E042199BDB19CBA8D45969EF7F6EF89310F208565E906EB241EB719941CB90

Function 017E26EC Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110a0d0f969f7e0e32fec1aa515f41e9989ee54f5a7b9f9c358622dacf46ca87
Instruction ID: 23dc5f02bb8c42c2cc0da54d61588cb59e4d150052192001b68fa9fcc6ebf1b9
Opcode Fuzzy Hash: 110a0d0f969f7e0e32fec1aa515f41e9989ee54f5a7b9f9c358622dacf46ca87
Instruction Fuzzy Hash: A1410FB0900349DFDB14CFA9C584ADEBFF5FF48714F248029E909AB254DB75A949CB90

Function 017EEEFC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b49125ab4c38477069218d8c2e596e706f8d40c1b21e9d3005e6f5aff32b79e
Instruction ID: 7f0baac5bc933977585fcd582ee53c17f499ace165d20411739bd8084b636973
Opcode Fuzzy Hash: 5b49125ab4c38477069218d8c2e596e706f8d40c1b21e9d3005e6f5aff32b79e
Instruction Fuzzy Hash: 70316F34A106169BDB15CF69D89969EFBF2BF89310F10C929E806E7341DB71AC45CB50

Function 017EEF00 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cbd403d1225fb627f01ce3b9cad8d17cdf2c4f3a72bb35abc7172da3a36a65
Instruction ID: f374770dd457029a873bb0eb0166ef127fa951da4cff17b618e1c26e2832d818
Opcode Fuzzy Hash: 30cbd403d1225fb627f01ce3b9cad8d17cdf2c4f3a72bb35abc7172da3a36a65
Instruction Fuzzy Hash: E7316D34A1061A9BDB15CF69D89969EFBF2BF88310F10C929E806E7341DB71AC45CB40

Function 017E26F8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4922da6c664ce1f83a0ee2b3c68065d5eb2f2a98bf8455565b70d1a52e4f65bc
Instruction ID: ed1139bfc204822f72db9927ed408f5650af4b7d9f633d25d07a989a57e565e8
Opcode Fuzzy Hash: 4922da6c664ce1f83a0ee2b3c68065d5eb2f2a98bf8455565b70d1a52e4f65bc
Instruction Fuzzy Hash: 1041EDB0D00349DFDB14CFA9C984A9EBBF5AF48310F208029E909AB254DB75A945CB90

Function 017E50B8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09b191a70dc623ae6425a0ed753f41821c08f13b78414e8d0dda0f118da2dd7
Instruction ID: eb5a0208d4660fa4d32fd15164a0e0065013c84bc9cc98672d8fd8d26e51f188
Opcode Fuzzy Hash: e09b191a70dc623ae6425a0ed753f41821c08f13b78414e8d0dda0f118da2dd7
Instruction Fuzzy Hash: DB311A34700219CFDB25EB78D9186AEB7F2AF4C244F5004A8D501AB3A4EF3ADD01CBA1

Function 017E50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663cc71b5143f4f5f24bffbf57e307f23947587cfa006ae107c785782b58bc7a
Instruction ID: fe4a4512370b2eaadf819a3389836ca6d84382dd921f2f2841e2b691e5a5392a
Opcode Fuzzy Hash: 663cc71b5143f4f5f24bffbf57e307f23947587cfa006ae107c785782b58bc7a
Instruction Fuzzy Hash: C4310B34700259CFDB65DB38D5586AEB7F2AF8C248F5004A9D502EB3A4DB3ADD41CBA1

Function 017E149C Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc6741981f5f1ca6aa15fee926c2bdbd84b4b16a719c800421df12ad9e87d59
Instruction ID: 49bc90c93128094edb596be015881b21e4394aee3584dec3e461d520ce913bd0
Opcode Fuzzy Hash: 3dc6741981f5f1ca6aa15fee926c2bdbd84b4b16a719c800421df12ad9e87d59
Instruction Fuzzy Hash: 9921B431B002028BDF329BBC944D3AEBBE5EB4E215F54047AE80AD7345E735C881CB91

Function 017E8D51 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0f8273676a9bdaf4d16e6a259fb3666e1c617674735ee0ac2bf105e98d0fbd
Instruction ID: 247f985f0ffe7498cef2ba0ec057f15e9e9f06b3e37b9f67dd2222b058971168
Opcode Fuzzy Hash: 7a0f8273676a9bdaf4d16e6a259fb3666e1c617674735ee0ac2bf105e98d0fbd
Instruction Fuzzy Hash: 40315E30E0020A9BDB16CF69D99879EF7F2FF9D300F10C629E805AB251DB719885CB91

Function 017E8D58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4436f4e92c7b54bad24a47a6142da1c027bab66037522ec6b7b7ae4d3c1aa79c
Instruction ID: 5a154707888ad80e728b18a2212c7deb099260242de00bfa5e6ac169d05f5b53
Opcode Fuzzy Hash: 4436f4e92c7b54bad24a47a6142da1c027bab66037522ec6b7b7ae4d3c1aa79c
Instruction Fuzzy Hash: 80214D30A1020A9BDB16CF69D99879EF7F2FF8D300F108629E805AB251DB719885CB91

Function 017E8C49 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1c3d5f162f6c880074b74fe11bbb6312f2d7c2635a05b6aea49145aeedd67b
Instruction ID: 7b21ddffc257fed3d1921a91934f4a4998800061ab040bc0bc1edccea1455acb
Opcode Fuzzy Hash: 7d1c3d5f162f6c880074b74fe11bbb6312f2d7c2635a05b6aea49145aeedd67b
Instruction Fuzzy Hash: E321B570E012199BCB06CFA8C8446DEF7F2AF8E300F50855AE812FB351DB719846CB91

Function 017E1380 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c311a55619ad45a75e2712850c99b176c9d90fc8bbb5a7018a55efeddaf1681
Instruction ID: c4a197497892c4f716627bdcaefd58b99ce4bd0517c0dcca3a957827f043a63f
Opcode Fuzzy Hash: 0c311a55619ad45a75e2712850c99b176c9d90fc8bbb5a7018a55efeddaf1681
Instruction Fuzzy Hash: A8217170A00301DBDB32567CE44D7697BE1EB4B359F90186AE90AC7396DA3D8984CB42

Function 017E16B0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9451132854a65dd2f9fa5f0897471f8ccf319c0dbfd556038a11fc62ee7c7d7d
Instruction ID: 57e3909bcc45ed685a90fe1062ec325da7d5e608c00cd28ff0971edcd69b11cd
Opcode Fuzzy Hash: 9451132854a65dd2f9fa5f0897471f8ccf319c0dbfd556038a11fc62ee7c7d7d
Instruction Fuzzy Hash: BD21C470700202DBEB31D73CF98C75A7BE6EB89714F406929E40AC7256EA3D9C41CB81

Function 0160D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572112864.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_160d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f73695cb12c2eb2cfe0c0c14734ca7d61e940861e5483662e076b0dc19d2048
Instruction ID: c2074e5108b3db7851e4ab3ffdccb6d262bbc0fffe880e7ae56892c93242f60f
Opcode Fuzzy Hash: 9f73695cb12c2eb2cfe0c0c14734ca7d61e940861e5483662e076b0dc19d2048
Instruction Fuzzy Hash: BF210075604200EFDB1ADF98D980B27BB65EB84314F20C66DD90E4B392C37AD447CA61

Function 017E1888 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f4b1bf9c37d9a9b09c7ce1f05b40a7012a41fe9bc48d26d67f939a69e5b712
Instruction ID: ba44cbaf0262ce6b2f9d4542b9e38b2db8225fe6385f0eb387608daaab674c7d
Opcode Fuzzy Hash: 19f4b1bf9c37d9a9b09c7ce1f05b40a7012a41fe9bc48d26d67f939a69e5b712
Instruction Fuzzy Hash: FD218131701285CFDF65EB78D55969EBBF1AF4D204F9004A9C106EB361DB368D41CB61

Function 017E1898 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4142edf6c56dca5d920c2ddd533244969f21d3b1eb002392891499efad72a6
Instruction ID: e7b533c1dbbe7de3c85d326aced07ca4de7df68375aa86b37432aed8dfb68206
Opcode Fuzzy Hash: 0d4142edf6c56dca5d920c2ddd533244969f21d3b1eb002392891499efad72a6
Instruction Fuzzy Hash: 93213D30B00245CFDB64DB78D55A6AEB7F6AF4D245F5004A8C106EB364EF368D41CBA1

Function 017E8C58 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52aee0d955f267b235ea41f93192b8a8ae2349b7ad41ae071874d7496a91eff1
Instruction ID: dd077137ecb3d6d43f46ccaa4edaa8a7378aeb4b59e0f357926a4a04ae685c5f
Opcode Fuzzy Hash: 52aee0d955f267b235ea41f93192b8a8ae2349b7ad41ae071874d7496a91eff1
Instruction Fuzzy Hash: BB218030E0160A9BDB19CFA8C85869EF7F2AF8D310F10C56AE811F7350DB719841CB91

Function 017E6B97 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eaa45f799bb85d677656da08a001d9d779deb3986de6f3b02a9d8be1d7ff917
Instruction ID: 9c29d73983afaaa595a737c4a93e861e00ecbd823a95b20c6230946d18a5a807
Opcode Fuzzy Hash: 1eaa45f799bb85d677656da08a001d9d779deb3986de6f3b02a9d8be1d7ff917
Instruction Fuzzy Hash: 392105316093919FC716AB38842826ABFF1EF8B204B0544EFD445CB2A6EE758806C791

Function 017E16C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38158e23fb30094ce489bf53ad6bb66765a9554683d1510f4d9d4aaf58bb1bd5
Instruction ID: be4ee870f3c5cf6e590618974ae1e9374758b074b3f0061f121f55b7394c7867
Opcode Fuzzy Hash: 38158e23fb30094ce489bf53ad6bb66765a9554683d1510f4d9d4aaf58bb1bd5
Instruction Fuzzy Hash: FA219D307001029BEB31DA3CF98CB597BD6EB8C754F406929E90ACB256EA7D9C518B91

Function 017E4FA8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9522293dcdf33b9469a9f6ead6ce892d6c7d43130ff14240d801bac00e8684
Instruction ID: cc7b72ea9b45f8e170a7d881804fa6282330ccc626ee815ea0b2fae8602f1357
Opcode Fuzzy Hash: 4b9522293dcdf33b9469a9f6ead6ce892d6c7d43130ff14240d801bac00e8684
Instruction Fuzzy Hash: 5B211934700208CFDB64DB78D95CAADBBF1EB4D619B1004A9E506EB364DB369D40CBA1

Function 017E0838 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3683bb938cd86a88ef13980a5e1b7eab74e81fa7357f8869636b273ac5c3a678
Instruction ID: 94b0ed9444efb995de338fbea43703a95556d3b0ca4fa7b554c1ebaf702a45d4
Opcode Fuzzy Hash: 3683bb938cd86a88ef13980a5e1b7eab74e81fa7357f8869636b273ac5c3a678
Instruction Fuzzy Hash: 3411C830B413054FEF265A7C941876A77E0EB8A214F24497EE046CF243D6A5CC418FC1

Function 0160D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572112864.000000000160D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_160d000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dbeb1bf0799e3035dd56484360466294dba98e40d6f4473469c050bf959bc4
Instruction ID: 3be7e1db3554a0328fa91c42e1c8f064101d73bf86ce7a03564075b8f16a620d
Opcode Fuzzy Hash: 70dbeb1bf0799e3035dd56484360466294dba98e40d6f4473469c050bf959bc4
Instruction Fuzzy Hash: D32192755093808FCB07CF64D990716BF71EB46214F28C6DAD8498F6A7C33AD80ACB62

Function 017E0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af730221c89cc500b1b613b784b596cd3606bb04167be4375211c19885138b6
Instruction ID: f142665c3d4a20c0d40ca06b53974f95aa24003a12dd692d776f06065ec0f86e
Opcode Fuzzy Hash: 8af730221c89cc500b1b613b784b596cd3606bb04167be4375211c19885138b6
Instruction Fuzzy Hash: 2F119E30B402098BEF259A7DD85876AB6E5FB8D714F204979E146CF246DAA9CC818FC1

Function 017E14A8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7ee1eca3b89dceccfc7a89f9a78d1a923ea122c344a68f297c24d99e6948e8
Instruction ID: 945a3a8eaebab1b3ed3ff347756eb27bad28f8805cbe5120a2ed8de41765c3f4
Opcode Fuzzy Hash: 0e7ee1eca3b89dceccfc7a89f9a78d1a923ea122c344a68f297c24d99e6948e8
Instruction Fuzzy Hash: 62014031B016158BCF21EFB884591ADFBF5EF4C214B6404BAE80AE7301E775D941CB91

Function 017E7BF3 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc55d72977f21b3113048fc4cc963974e968a08b94162410cc4acfda31e03960
Instruction ID: d364e0fa8c7704bf2338c15bef266792b134befd27982f5c3fbbaff7461340ff
Opcode Fuzzy Hash: fc55d72977f21b3113048fc4cc963974e968a08b94162410cc4acfda31e03960
Instruction Fuzzy Hash: A2018F30A0024BEBDB15EBBCF98499C7BF1EB84340F5052BCC5056B291EE7A2E15DB81

Function 017E1534 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb63d9c02db1cb2b9afc7e9973f3ba1a3476495448f6b16fa5df7dc8df1d7f0
Instruction ID: f7166f0f316960bcb2565504e59b979f372dd04e5a53f4ef1ad1e1e2c8cbd62d
Opcode Fuzzy Hash: 2bb63d9c02db1cb2b9afc7e9973f3ba1a3476495448f6b16fa5df7dc8df1d7f0
Instruction Fuzzy Hash: 26F0F033A04210CBDB12CBA8989A1ACFFF1EA6C2117AD00D7E907DB312D274E912CB51

Function 017E7BF8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4572673897.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17e0000_skyT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c704d387cdfdd64670c90aa330e6debcc9cdeef3ce75acf58636396c974a698
Instruction ID: 803a2d1611a6908a644c061672b3bb778de25132bf487c79d2432e9e59bc8b4f
Opcode Fuzzy Hash: 2c704d387cdfdd64670c90aa330e6debcc9cdeef3ce75acf58636396c974a698
Instruction Fuzzy Hash: C8F03C30A0014BEFDB04EFB8F98499D7BB1EB84340F50627DC509A7250EE7A6E14DB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\skyT.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdqkews5.pfg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lusoxbnx.xvu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sxmetalv.zzq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y4dq2nki.fh1.psm1

C:\Users\user\AppData\Roaming\skyT\skyT.exe

C:\Users\user\AppData\Roaming\skyT\skyT.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exe

Function 017CD490 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 017CD4A0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 073C93ED Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 073C93F8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 017CB208 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 017C4874 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 017C5D1C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 073C8D68 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 073C8D70 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 073C8E58 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre