Edit tour

Windows Analysis Report
IMG 003.exe

Overview

General Information

Sample name:	IMG 003.exe
Analysis ID:	1467967
MD5:	605e5a50ebdec57b636cff6353684913
SHA1:	891d2beea2edaa689cd3cfedc1e30f4ec5dde82e
SHA256:	30225014a390133cd81a5896e070c88313e33c21c6cb40d9fec1600bf9f70f4f
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

IMG 003.exe (PID: 6676 cmdline: "C:\Users\user\Desktop\IMG 003.exe" MD5: 605E5A50EBDEC57B636CFF6353684913)

powershell.exe (PID: 5828 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7052 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7496 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5700 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IMG 003.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\IMG 003.exe" MD5: 605E5A50EBDEC57B636CFF6353684913)

aBYKwaZ.exe (PID: 7456 cmdline: C:\Users\user\AppData\Roaming\aBYKwaZ.exe MD5: 605E5A50EBDEC57B636CFF6353684913)

schtasks.exe (PID: 7628 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aBYKwaZ.exe (PID: 7680 cmdline: "C:\Users\user\AppData\Roaming\aBYKwaZ.exe" MD5: 605E5A50EBDEC57B636CFF6353684913)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "wizzy@transmedmaritime.cf", "Password": "!feanyi#@12"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2918405791.000000000307B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2918405791.0000000003090000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.2918450759.0000000002B00000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IMG 003.exe PID: 6676	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IMG 003.exe PID: 6676	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: IMG 003.exe PID: 6676	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IMG 003.exe PID: 7252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IMG 003.exe PID: 7252	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: aBYKwaZ.exe PID: 7456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aBYKwaZ.exe PID: 7456	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: aBYKwaZ.exe PID: 7456	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: aBYKwaZ.exe PID: 7680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aBYKwaZ.exe PID: 7680	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.IMG 003.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.IMG 003.exe.439e370.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.IMG 003.exe.439e370.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.IMG 003.exe.439e370.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.aBYKwaZ.exe.459ec50.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.aBYKwaZ.exe.459ec50.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.aBYKwaZ.exe.459ec50.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.IMG 003.exe.43d8d90.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.IMG 003.exe.43d8d90.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.IMG 003.exe.43d8d90.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.aBYKwaZ.exe.4564230.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.aBYKwaZ.exe.4564230.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.aBYKwaZ.exe.4564230.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3162f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3172b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31827:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31899:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3192f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.IMG 003.exe.43d8d90.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.IMG 003.exe.43d8d90.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.IMG 003.exe.43d8d90.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.IMG 003.exe.43d8d90.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dcc1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dddd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de47:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6deb9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6dfdf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.aBYKwaZ.exe.459ec50.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.aBYKwaZ.exe.459ec50.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.aBYKwaZ.exe.459ec50.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.aBYKwaZ.exe.459ec50.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dcc1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dddd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de47:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6deb9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df4f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6dfdf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.IMG 003.exe.439e370.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.IMG 003.exe.439e370.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.IMG 003.exe.439e370.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.IMG 003.exe.439e370.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6de4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa866f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dec1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa86e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6df4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa876b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dfdd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa87fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e047:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8867:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e0b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa88d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e14f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa896f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
9.2.aBYKwaZ.exe.4564230.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.aBYKwaZ.exe.4564230.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.aBYKwaZ.exe.4564230.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.aBYKwaZ.exe.4564230.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3342f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6de4f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa866f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dec1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa86e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3352b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6df4b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa876b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dfdd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa87fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33627:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e047:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8867:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33699:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e0b9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa88d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3372f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e14f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa896f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\IMG 003.exe", ParentImage: C:\Users\user\Desktop\IMG 003.exe, ParentProcessId: 6676, ParentProcessName: IMG 003.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe", ProcessId: 5828, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\aBYKwaZ.exe, ParentImage: C:\Users\user\AppData\Roaming\aBYKwaZ.exe, ParentProcessId: 7456, ParentProcessName: aBYKwaZ.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp", ProcessId: 7628, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\IMG 003.exe, Initiated: true, ProcessId: 7252, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\IMG 003.exe", ParentImage: C:\Users\user\Desktop\IMG 003.exe, ParentProcessId: 6676, ParentProcessName: IMG 003.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp", ProcessId: 5700, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\IMG 003.exe", ParentImage: C:\Users\user\Desktop\IMG 003.exe, ParentProcessId: 6676, ParentProcessName: IMG 003.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe", ProcessId: 5828, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\IMG 003.exe", ParentImage: C:\Users\user\Desktop\IMG 003.exe, ParentProcessId: 6676, ParentProcessName: IMG 003.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp", ProcessId: 5700, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.yandex.com", "Username": "wizzy@transmedmaritime.cf", "Password": "!feanyi#@12"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Virustotal: Detection: 40%			Perma Link

Multi AV Scanner detection for submitted file

Source: IMG 003.exe	ReversingLabs: Detection: 31%
Source: IMG 003.exe	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: IMG 003.exe

Joe Sandbox ML: detected

Source: IMG 003.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: IMG 003.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: frGi.pdb source: IMG 003.exe, aBYKwaZ.exe.0.dr
Source:	Binary string: frGi.pdbSHA256 source: IMG 003.exe, aBYKwaZ.exe.0.dr

Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 4x nop then jmp 0192A915h		0_2_0192AD52
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 4x nop then jmp 0DCC9B75h		9_2_0DCC9FDB

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 77.88.21.158:587

Source: Joe Sandbox View	IP Address: 77.88.21.158 77.88.21.158
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 77.88.21.158:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.yandex.com

Source: aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000648F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0j
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000647F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.0000000006463000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.000000000144E000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000648F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000648F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.000000000144E000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000648F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000647F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.0000000006463000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: IMG 003.exe, 00000000.00000002.1706447663.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 00000009.00000002.1769731116.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000648F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.000000000307B000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D53000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: IMG 003.exe, aBYKwaZ.exe.0.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: IMG 003.exe, 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2914141071.0000000000435000.00000040.00000400.00020000.00000000.sdmp, aBYKwaZ.exe, 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: IMG 003.exe, 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2914163281.0000000000431000.00000040.00000400.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009833000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2945385002.0000000009805000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2932744566.0000000006A5A000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2916285074.000000000144E000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000647F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.0000000006463000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2932714515.000000000648F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008740000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2946210868.0000000008790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, SKTzxzsJw.cs	.Net Code: vTmhWR
Source: 0.2.IMG 003.exe.439e370.4.raw.unpack, SKTzxzsJw.cs	.Net Code: vTmhWR

Installs a global keyboard hook

Source: C:\Users\user\Desktop\IMG 003.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\IMG 003.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Source: C:\Users\user\Desktop\IMG 003.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.IMG 003.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.IMG 003.exe.439e370.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.aBYKwaZ.exe.459ec50.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.IMG 003.exe.43d8d90.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.aBYKwaZ.exe.4564230.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.aBYKwaZ.exe.459ec50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.IMG 003.exe.439e370.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.IMG 003.exe.95f0000.6.raw.unpack, -Module-.cs	Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
Source: 0.2.IMG 003.exe.331b4d4.1.raw.unpack, -Module-.cs	Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088

Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_0175DDEC	0_2_0175DDEC
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01926340	0_2_01926340
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01926348	0_2_01926348
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01924430	0_2_01924430
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01924868	0_2_01924868
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_0192DA68	0_2_0192DA68
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01924CA0	0_2_01924CA0
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01926CF8	0_2_01926CF8
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012FE299	8_2_012FE299
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012FA968	8_2_012FA968
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012F4A98	8_2_012F4A98
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012F3E80	8_2_012F3E80
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012F41C8	8_2_012F41C8
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012F19A0	8_2_012F19A0
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CBB283	8_2_06CBB283
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB30E0	8_2_06CB30E0
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB76F8	8_2_06CB76F8
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CBE400	8_2_06CBE400
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB0040	8_2_06CB0040
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06DA1908	8_2_06DA1908
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06DA1903	8_2_06DA1903
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB0023	8_2_06CB0023
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB0038	8_2_06CB0038
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0110DDEC	9_2_0110DDEC
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCCCCC8	9_2_0DCCCCC8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC6CF8	9_2_0DCC6CF8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC4CA0	9_2_0DCC4CA0
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC4868	9_2_0DCC4868
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC4418	9_2_0DCC4418
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC4430	9_2_0DCC4430
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC6348	9_2_0DCC6348
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC633A	9_2_0DCC633A
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D041C8	13_2_00D041C8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D0A968	13_2_00D0A968
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D04A98	13_2_00D04A98
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D0AB1C	13_2_00D0AB1C
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D0DCC0	13_2_00D0DCC0
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D03E80	13_2_00D03E80
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B6648	13_2_066B6648
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B5628	13_2_066B5628
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B7DD8	13_2_066B7DD8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066BB283	13_2_066BB283
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B30E0	13_2_066B30E0
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066BC1E8	13_2_066BC1E8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B76F8	13_2_066B76F8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B2408	13_2_066B2408
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066BE400	13_2_066BE400
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B5D3B	13_2_066B5D3B
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B0040	13_2_066B0040
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067AE4E8	13_2_067AE4E8
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A18CA	13_2_067A18CA
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A1908	13_2_067A1908
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A1902	13_2_067A1902
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_066B0022	13_2_066B0022

Source: IMG 003.exe, 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000002.1714374757.0000000007AB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000002.1715011158.00000000095F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000002.1705002448.00000000013CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000002.1706447663.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000002.1706447663.00000000033C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedf8fc031-c024-49b7-9cf2-cdfecdf01d4a.exe4 vs IMG 003.exe
Source: IMG 003.exe, 00000000.00000000.1640910658.0000000000E9A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefrGi.exeD vs IMG 003.exe
Source: IMG 003.exe, 00000008.00000002.2914886404.00000000010F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs IMG 003.exe
Source: IMG 003.exe	Binary or memory string: OriginalFilenamefrGi.exeD vs IMG 003.exe

Source: IMG 003.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.IMG 003.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.IMG 003.exe.439e370.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.aBYKwaZ.exe.459ec50.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.IMG 003.exe.43d8d90.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.aBYKwaZ.exe.4564230.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.aBYKwaZ.exe.459ec50.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.IMG 003.exe.439e370.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: IMG 003.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: aBYKwaZ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, f0Pi2hT7uJL80FX4Rh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, f0Pi2hT7uJL80FX4Rh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\IMG 003.exe

File created: C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4484:120:WilError_03
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Mutant created: \Sessions\1\BaseNamedObjects\xcoDYPZI
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4884:120:WilError_03

Source: C:\Users\user\Desktop\IMG 003.exe

File created: C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp

Jump to behavior

Source: IMG 003.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: IMG 003.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\IMG 003.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: IMG 003.exe	ReversingLabs: Detection: 31%
Source: IMG 003.exe	Virustotal: Detection: 40%

Source: C:\Users\user\Desktop\IMG 003.exe

File read: C:\Users\user\Desktop\IMG 003.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\IMG 003.exe "C:\Users\user\Desktop\IMG 003.exe"
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Users\user\Desktop\IMG 003.exe "C:\Users\user\Desktop\IMG 003.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\aBYKwaZ.exe C:\Users\user\AppData\Roaming\aBYKwaZ.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process created: C:\Users\user\AppData\Roaming\aBYKwaZ.exe "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Users\user\Desktop\IMG 003.exe "C:\Users\user\Desktop\IMG 003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process created: C:\Users\user\AppData\Roaming\aBYKwaZ.exe "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\IMG 003.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\IMG 003.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: IMG 003.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: IMG 003.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: IMG 003.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: frGi.pdb source: IMG 003.exe, aBYKwaZ.exe.0.dr
Source:	Binary string: frGi.pdbSHA256 source: IMG 003.exe, aBYKwaZ.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: IMG 003.exe, MainForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: aBYKwaZ.exe.0.dr, MainForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.IMG 003.exe.95f0000.6.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.IMG 003.exe.95f0000.6.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	.Net Code: nMkImFVXFc System.Reflection.Assembly.Load(byte[])
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	.Net Code: nMkImFVXFc System.Reflection.Assembly.Load(byte[])
Source: 0.2.IMG 003.exe.331b4d4.1.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.IMG 003.exe.331b4d4.1.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])

Source: IMG 003.exe

Static PE information: 0xE8A28A03 [Sat Sep 5 05:17:55 2093 UTC]

Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_019204EA push edx; ret	0_2_019204EB
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 0_2_01923618 push esp; iretd	0_2_01923621
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_012F0C55 push edi; retf	8_2_012F0C7A
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB8418 push ebx; ret	8_2_06CB841A
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB8833 push esi; ret	8_2_06CB8836
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB8830 push edi; ret	8_2_06CB8832
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06CB496B push ss; ret	8_2_06CB496E
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06DA6C33 push es; ret	8_2_06DA6C40
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06DA7670 push esp; iretd	8_2_06DA7679
Source: C:\Users\user\Desktop\IMG 003.exe	Code function: 8_2_06DA7C24 push esp; iretd	8_2_06DA7C2D
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCCE905 push FFFFFF8Bh; iretd	9_2_0DCCE907
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC04EA push edx; ret	9_2_0DCC04EB
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 9_2_0DCC3618 push esp; iretd	9_2_0DCC3621
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D00617 push edx; retf	13_2_00D0061A
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D00838 push edx; retf	13_2_00D00846
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_00D00C55 push edi; retf	13_2_00D00C7A
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A6C32 push es; ret	13_2_067A6C40
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A7670 push esp; iretd	13_2_067A7679
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A11B5 push ebx; retf	13_2_067A11BC
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A7C24 push esp; iretd	13_2_067A7C2D
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Code function: 13_2_067A7944 push ebx; retf	13_2_067A7945

Source: IMG 003.exe	Static PE information: section name: .text entropy: 7.544396745144058
Source: aBYKwaZ.exe.0.dr	Static PE information: section name: .text entropy: 7.544396745144058

Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, XSIdLuSHVVMbXEBnRk.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kyBVc9CvEL', 'HI2VaNvHf0', 'KjlVzJRVyL', 'R6rqHxj2Qj', 'MWPqAxDpBq', 'tW4qVOFeWB', 'lkqqqyf1c0', 'qM68DNsUKJ1vMRVARev'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, h3CmZSIWZKFQJ3whsE.cs	High entropy of concatenated method names: 'FX9Au0Pi2h', 'zuJAfL80FX', 'sEQAO7EJHg', 'FmhAYiprwA', 'J8lAnswXxo', 'R7eA1qglrv', 'R2th4bjNqmNcgs0vVF', 'tKrWHhlb7fdnB4aE51', 'uLrAA9UNVY', 'C52AqebgjE'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, UcyrsfJpC81Cwfa1WS.cs	High entropy of concatenated method names: 'a3yu9S240r', 'aR5uSAOUNE', 'j6Hu8uQ3ah', 'LJR8asdiEG', 'GU78zuabnO', 'MDvuHhhfdH', 'pH4uAJOGh2', 'Kq0uVcuk3J', 'VX4uqFRw3k', 'iOhuIbtgKn'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, DIC77dcbVGfb0ZKQVI.cs	High entropy of concatenated method names: 'XEeU4GwqeU', 'H4eU3jX6YF', 'stQUkePExK', 'ftKUDvK9c6', 'edDU2gm4fN', 'uDGULaNns8', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, xxo27e4qglrvAQrsmi.cs	High entropy of concatenated method names: 'L9J8j4Avtb', 'oPn8GaLDvR', 'cm58FABb2P', 'MSc8u4ZlX4', 'LHZ8fd85Oe', 'ongFEiNraw', 'QkWFpMd2RO', 'UisFZFcy2y', 'mLlF0DjUm8', 'rLMFcFFVet'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, xrw0tlAqqY7H3tKyYi0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Fmld2etOMC', 'XycdRv6MOt', 'WkBdwx3NcU', 'vSRdhxflqx', 'Q0QdEx2JiP', 'bfqdpS4NHv', 'hIkdZ97os2'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, IDqXVQV0QpWLHAPx2x.cs	High entropy of concatenated method names: 'Sdom3opLx', 'ouf7f70Cf', 'd5otjZnwW', 'Bn6y8U6Uf', 'k61PjhHEZ', 'sfx5Wlr5w', 'haS3Q7EkOSsxBWUSvt', 'sgHS71fOMkSjeI4qXo', 'SHNUZPvBu', 'CIGdWsr7C'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, vWh1BKpdAe6ULESqsB.cs	High entropy of concatenated method names: 'xvti0jENeD', 'KjmiaV5aGF', 'pPnUH4odtW', 'iZMUAns2NU', 'e9RiBHPj60', 'dDmiNo3eOe', 'tsoivmMOAq', 'Gj3i2RFJEM', 'NKNiRfFy1q', 'AvRiwnyhut'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, HTRRXi25oIY0C1PIAY.cs	High entropy of concatenated method names: 'Nran6huSIp', 'b09nNl42rA', 'rban2J9ilq', 'DZXnRSAMf8', 'TZqn34ejWV', 'AjbnkELx4d', 'u7DnDRGdt2', 'PpTnLfqCxF', 'wl1nWn8Sjv', 'saGnJHC1eg'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, a4CNNYw48AkfsbTdWY.cs	High entropy of concatenated method names: 'ToString', 'aDa1BjGjBN', 'ihT13Tc0PB', 'njW1kxRBwG', 's721DjkPg2', 'Aa21LP9CDh', 'h1f1W6UPkU', 'iri1J9uU5Q', 'qck1ly9L0L', 'zAm1bRqINo'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, OAZtfoGelWqo8FNBrD.cs	High entropy of concatenated method names: 'Dispose', 'g2OAcXoIwx', 'uuOV3Pr1KI', 'BDj99cY5g4', 'ebfAahJ2PH', 'zoXAzP58iy', 'ProcessDialogKey', 'B9yVHIC77d', 'MVGVAfb0ZK', 'tVIVVXATW3'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, Y8MTZFAH1SfBEO3hiI0.cs	High entropy of concatenated method names: 'dcnxoO9EWK', 'hPQxKnweWN', 'Qdrxmtmq9Q', 'aTJx70Ty2t', 'zhJxgBMHpH', 'SPextngJnL', 'lP0xyQT1G4', 'FICxTupXj9', 'lgexP7xk46', 'gUBx5i26aL'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, aa5nAO3deR1t0CtJ8c.cs	High entropy of concatenated method names: 'jr4GBuhFl0y64dYGpIb', 'FNbtCFhAmamDjeJRTum', 'QtY8Unhyuk', 'Mv18xWCptP', 'Eb38dBKc2N', 'ItHelshis1EZVAiCB1l', 'Cu4oNKhdVS61DgiokBK'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, VrwABt5xyMU7KL8lsw.cs	High entropy of concatenated method names: 'gUpFgUJ1g5', 'INJFy0ppFi', 'V6MSkCCPlT', 'CXGSDa0aM6', 'JDHSLfRO08', 'Ka6SWfFrsY', 'CeXSJe4Ofj', 'Do2SlkFi9o', 'jwBSbMqXcY', 'D8wS6Rgsey'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	High entropy of concatenated method names: 'vkIqjaC0bO', 'yPAq9e2jcq', 'WQaqGduPh9', 'YDOqSON9P6', 'CUoqFqqOEB', 'KL1q8DAshB', 'CWCqumIODW', 'evHqfihcs0', 'PP2qCVDZSv', 'bsDqOBX3TB'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, nXy3Qav2iClUHmsmKf.cs	High entropy of concatenated method names: 'LiBMTnNPAj', 'NkYMPUFmtk', 'lNjM4sHHFI', 'ocxM39f144', 'RCLMDu01hY', 'ViwMLYZLFA', 'GO3MJoOmXS', 'T3iMlkrCdL', 'jJAM6hpHA0', 'IrmMBDQgAf'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, f0Pi2hT7uJL80FX4Rh.cs	High entropy of concatenated method names: 'hF9G2Ks7OB', 'aOKGRd2dAR', 'YEBGwgrWB6', 'bLsGhHaOkW', 'rJOGEFI0NO', 'Fu2Gp2rrVs', 'NtAGZPcTPP', 'DGKG0LXSLV', 'IgBGcb301K', 'oktGa6RPqq'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, FRvlGNAATApnSHHZXZS.cs	High entropy of concatenated method names: 'ToString', 'pHpdqGovfT', 'mMGdI3Y6kJ', 'sfOdjr0FWo', 'TH4d9NvLvt', 'VP1dGt6PNT', 'WlxdSwxX47', 'rDvdF3yqt0', 'BKwUFgUrhFBkdpbOKSq', 'GDBoq5UQFXgAl82TfOu'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, xATW3Naow795m2pvhD.cs	High entropy of concatenated method names: 'glvxAeu2ve', 'N2XxqJZTGr', 'pXsxIS0GOW', 'DeNx9OE07l', 'DcIxGGhs26', 'sTSxFvDvUJ', 'fuHx8qNEsj', 'qB0UZyE8eq', 'tcMU0OC33q', 'ShoUcV9Csx'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, TflZ91bZCGQd4nk0Hs.cs	High entropy of concatenated method names: 'VXouovTkyg', 'SFAuKqRvKQ', 'UqTum5RQwg', 'dLOu7Ekf9j', 'r9GugTvVGP', 'DdsutV6ncg', 'HTIuy8f8xh', 'tc0uTXJ3jH', 'oEbuPbum6i', 'Sibu5kSAdL'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, MfhJ2P0HmoXP58iyg9.cs	High entropy of concatenated method names: 'fjxU9TmNex', 'fdgUGuQLuo', 'kVHUSdCNER', 'cHVUFscTOs', 'fdMU8HXHKx', 'WKsUujAAKh', 'X87UfNpUoL', 'KW8UCrSJo8', 'ixUUOfIimE', 'qqgUYWccTf'
Source: 0.2.IMG 003.exe.7ab0000.5.raw.unpack, DPuwadPEQ7EJHg5mhi.cs	High entropy of concatenated method names: 'c2VS7BEZHX', 'nBNSt78kZh', 'GHXSTbDXx4', 'Qe5SP4AvZJ', 'FViSnsCWiE', 'CRPS1cMjoG', 'agCSiOjhcF', 'DyYSUHWud3', 'PNSSxmYo68', 'PPZSduHlOr'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, XSIdLuSHVVMbXEBnRk.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'kyBVc9CvEL', 'HI2VaNvHf0', 'KjlVzJRVyL', 'R6rqHxj2Qj', 'MWPqAxDpBq', 'tW4qVOFeWB', 'lkqqqyf1c0', 'qM68DNsUKJ1vMRVARev'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, h3CmZSIWZKFQJ3whsE.cs	High entropy of concatenated method names: 'FX9Au0Pi2h', 'zuJAfL80FX', 'sEQAO7EJHg', 'FmhAYiprwA', 'J8lAnswXxo', 'R7eA1qglrv', 'R2th4bjNqmNcgs0vVF', 'tKrWHhlb7fdnB4aE51', 'uLrAA9UNVY', 'C52AqebgjE'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, UcyrsfJpC81Cwfa1WS.cs	High entropy of concatenated method names: 'a3yu9S240r', 'aR5uSAOUNE', 'j6Hu8uQ3ah', 'LJR8asdiEG', 'GU78zuabnO', 'MDvuHhhfdH', 'pH4uAJOGh2', 'Kq0uVcuk3J', 'VX4uqFRw3k', 'iOhuIbtgKn'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, DIC77dcbVGfb0ZKQVI.cs	High entropy of concatenated method names: 'XEeU4GwqeU', 'H4eU3jX6YF', 'stQUkePExK', 'ftKUDvK9c6', 'edDU2gm4fN', 'uDGULaNns8', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, xxo27e4qglrvAQrsmi.cs	High entropy of concatenated method names: 'L9J8j4Avtb', 'oPn8GaLDvR', 'cm58FABb2P', 'MSc8u4ZlX4', 'LHZ8fd85Oe', 'ongFEiNraw', 'QkWFpMd2RO', 'UisFZFcy2y', 'mLlF0DjUm8', 'rLMFcFFVet'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, xrw0tlAqqY7H3tKyYi0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Fmld2etOMC', 'XycdRv6MOt', 'WkBdwx3NcU', 'vSRdhxflqx', 'Q0QdEx2JiP', 'bfqdpS4NHv', 'hIkdZ97os2'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, IDqXVQV0QpWLHAPx2x.cs	High entropy of concatenated method names: 'Sdom3opLx', 'ouf7f70Cf', 'd5otjZnwW', 'Bn6y8U6Uf', 'k61PjhHEZ', 'sfx5Wlr5w', 'haS3Q7EkOSsxBWUSvt', 'sgHS71fOMkSjeI4qXo', 'SHNUZPvBu', 'CIGdWsr7C'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, vWh1BKpdAe6ULESqsB.cs	High entropy of concatenated method names: 'xvti0jENeD', 'KjmiaV5aGF', 'pPnUH4odtW', 'iZMUAns2NU', 'e9RiBHPj60', 'dDmiNo3eOe', 'tsoivmMOAq', 'Gj3i2RFJEM', 'NKNiRfFy1q', 'AvRiwnyhut'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, HTRRXi25oIY0C1PIAY.cs	High entropy of concatenated method names: 'Nran6huSIp', 'b09nNl42rA', 'rban2J9ilq', 'DZXnRSAMf8', 'TZqn34ejWV', 'AjbnkELx4d', 'u7DnDRGdt2', 'PpTnLfqCxF', 'wl1nWn8Sjv', 'saGnJHC1eg'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, a4CNNYw48AkfsbTdWY.cs	High entropy of concatenated method names: 'ToString', 'aDa1BjGjBN', 'ihT13Tc0PB', 'njW1kxRBwG', 's721DjkPg2', 'Aa21LP9CDh', 'h1f1W6UPkU', 'iri1J9uU5Q', 'qck1ly9L0L', 'zAm1bRqINo'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, OAZtfoGelWqo8FNBrD.cs	High entropy of concatenated method names: 'Dispose', 'g2OAcXoIwx', 'uuOV3Pr1KI', 'BDj99cY5g4', 'ebfAahJ2PH', 'zoXAzP58iy', 'ProcessDialogKey', 'B9yVHIC77d', 'MVGVAfb0ZK', 'tVIVVXATW3'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, Y8MTZFAH1SfBEO3hiI0.cs	High entropy of concatenated method names: 'dcnxoO9EWK', 'hPQxKnweWN', 'Qdrxmtmq9Q', 'aTJx70Ty2t', 'zhJxgBMHpH', 'SPextngJnL', 'lP0xyQT1G4', 'FICxTupXj9', 'lgexP7xk46', 'gUBx5i26aL'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, aa5nAO3deR1t0CtJ8c.cs	High entropy of concatenated method names: 'jr4GBuhFl0y64dYGpIb', 'FNbtCFhAmamDjeJRTum', 'QtY8Unhyuk', 'Mv18xWCptP', 'Eb38dBKc2N', 'ItHelshis1EZVAiCB1l', 'Cu4oNKhdVS61DgiokBK'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, VrwABt5xyMU7KL8lsw.cs	High entropy of concatenated method names: 'gUpFgUJ1g5', 'INJFy0ppFi', 'V6MSkCCPlT', 'CXGSDa0aM6', 'JDHSLfRO08', 'Ka6SWfFrsY', 'CeXSJe4Ofj', 'Do2SlkFi9o', 'jwBSbMqXcY', 'D8wS6Rgsey'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, vCSyCTfIWhq3JOLxpn.cs	High entropy of concatenated method names: 'vkIqjaC0bO', 'yPAq9e2jcq', 'WQaqGduPh9', 'YDOqSON9P6', 'CUoqFqqOEB', 'KL1q8DAshB', 'CWCqumIODW', 'evHqfihcs0', 'PP2qCVDZSv', 'bsDqOBX3TB'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, nXy3Qav2iClUHmsmKf.cs	High entropy of concatenated method names: 'LiBMTnNPAj', 'NkYMPUFmtk', 'lNjM4sHHFI', 'ocxM39f144', 'RCLMDu01hY', 'ViwMLYZLFA', 'GO3MJoOmXS', 'T3iMlkrCdL', 'jJAM6hpHA0', 'IrmMBDQgAf'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, f0Pi2hT7uJL80FX4Rh.cs	High entropy of concatenated method names: 'hF9G2Ks7OB', 'aOKGRd2dAR', 'YEBGwgrWB6', 'bLsGhHaOkW', 'rJOGEFI0NO', 'Fu2Gp2rrVs', 'NtAGZPcTPP', 'DGKG0LXSLV', 'IgBGcb301K', 'oktGa6RPqq'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, FRvlGNAATApnSHHZXZS.cs	High entropy of concatenated method names: 'ToString', 'pHpdqGovfT', 'mMGdI3Y6kJ', 'sfOdjr0FWo', 'TH4d9NvLvt', 'VP1dGt6PNT', 'WlxdSwxX47', 'rDvdF3yqt0', 'BKwUFgUrhFBkdpbOKSq', 'GDBoq5UQFXgAl82TfOu'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, xATW3Naow795m2pvhD.cs	High entropy of concatenated method names: 'glvxAeu2ve', 'N2XxqJZTGr', 'pXsxIS0GOW', 'DeNx9OE07l', 'DcIxGGhs26', 'sTSxFvDvUJ', 'fuHx8qNEsj', 'qB0UZyE8eq', 'tcMU0OC33q', 'ShoUcV9Csx'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, TflZ91bZCGQd4nk0Hs.cs	High entropy of concatenated method names: 'VXouovTkyg', 'SFAuKqRvKQ', 'UqTum5RQwg', 'dLOu7Ekf9j', 'r9GugTvVGP', 'DdsutV6ncg', 'HTIuy8f8xh', 'tc0uTXJ3jH', 'oEbuPbum6i', 'Sibu5kSAdL'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, MfhJ2P0HmoXP58iyg9.cs	High entropy of concatenated method names: 'fjxU9TmNex', 'fdgUGuQLuo', 'kVHUSdCNER', 'cHVUFscTOs', 'fdMU8HXHKx', 'WKsUujAAKh', 'X87UfNpUoL', 'KW8UCrSJo8', 'ixUUOfIimE', 'qqgUYWccTf'
Source: 0.2.IMG 003.exe.44bd220.2.raw.unpack, DPuwadPEQ7EJHg5mhi.cs	High entropy of concatenated method names: 'c2VS7BEZHX', 'nBNSt78kZh', 'GHXSTbDXx4', 'Qe5SP4AvZJ', 'FViSnsCWiE', 'CRPS1cMjoG', 'agCSiOjhcF', 'DyYSUHWud3', 'PNSSxmYo68', 'PPZSduHlOr'

Source: C:\Users\user\Desktop\IMG 003.exe

File created: C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\IMG 003.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 6676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7456, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 16F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 32B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 1890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 9750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: A750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: A960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: B960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: BD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: CD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 9750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: A960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: BD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 12F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Memory allocated: 5000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 86D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 96D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 98C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: A8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: AC90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: BC90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: CC90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: E030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: F030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 10030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 11030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 2A70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory allocated: 29C0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199940	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199811	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199702	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199593	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199484	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199374	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199265	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199156	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199047	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198929	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198828	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198718	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198609	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198499	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198390	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199953
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199843
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199734
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199624
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199515
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199406
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199284
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199168
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199046
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198937
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198828
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198718
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198609

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6468	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 594	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6997	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2246	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Window / User API: threadDelayed 3625	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Window / User API: threadDelayed 6209	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Window / User API: threadDelayed 7269
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Window / User API: threadDelayed 2585

Source: C:\Users\user\Desktop\IMG 003.exe TID: 6720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 6468 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7144	Thread sleep count: 594 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99778s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97767s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -97092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96544s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96428s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -96194s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -95921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -95725s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199940s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1199047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198929s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe TID: 7492	Thread sleep time: -1198281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99653s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99546s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99436s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99309s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99202s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -99087s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -98937s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -98742s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -98517s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -98334s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -98194s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -98078s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97968s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97749s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97640s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97531s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97421s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97312s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97203s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -97092s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96984s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96873s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96765s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96656s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96544s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96437s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96326s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96218s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -96109s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -95999s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -95890s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -95781s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -95671s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -95562s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199953s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199843s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199734s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199624s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199515s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199406s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199284s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199168s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1199046s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1198937s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1198828s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1198718s >= -30000s
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe TID: 7780	Thread sleep time: -1198609s >= -30000s

Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\IMG 003.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99778	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99124	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98879	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98546	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97889	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97767	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97531	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97420	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97311	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 97092	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96871	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96765	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96656	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96544	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96428	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 96194	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 95921	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 95725	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199940	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199811	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199702	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199593	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199484	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199374	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199265	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199156	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1199047	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198929	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198828	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198718	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198609	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198499	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198390	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Thread delayed: delay time: 1198281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99653
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99546
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99436
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99309
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99202
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 99087
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 98937
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 98742
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 98517
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 98334
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 98194
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 98078
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97968
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97749
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97640
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97531
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97421
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97312
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97203
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 97092
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96984
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96873
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96765
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96656
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96544
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96437
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96326
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96218
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 96109
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 95999
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 95890
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 95781
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 95671
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 95562
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199953
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199843
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199734
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199624
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199515
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199406
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199284
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199168
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1199046
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198937
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198828
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198718
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Thread delayed: delay time: 1198609

Source: IMG 003.exe, 00000008.00000002.2916285074.0000000001460000.00000004.00000020.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\IMG 003.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe"
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\IMG 003.exe	Memory written: C:\Users\user\Desktop\IMG 003.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Memory written: C:\Users\user\AppData\Roaming\aBYKwaZ.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Process created: C:\Users\user\Desktop\IMG 003.exe "C:\Users\user\Desktop\IMG 003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Process created: C:\Users\user\AppData\Roaming\aBYKwaZ.exe "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Users\user\Desktop\IMG 003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Users\user\Desktop\IMG 003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Users\user\AppData\Roaming\aBYKwaZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Users\user\AppData\Roaming\aBYKwaZ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\IMG 003.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2918405791.000000000307B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 6676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7680, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\IMG 003.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\IMG 003.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\IMG 003.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\aBYKwaZ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 6676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7680, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.43d8d90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.459ec50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG 003.exe.439e370.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.aBYKwaZ.exe.4564230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2918405791.000000000307B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2918450759.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 6676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IMG 003.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aBYKwaZ.exe PID: 7680, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
IMG 003.exe	32%	ReversingLabs
IMG 003.exe	41%	Virustotal	Browse
IMG 003.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\aBYKwaZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\aBYKwaZ.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal
C:\Users\user\AppData\Roaming\aBYKwaZ.exe	41%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
smtp.yandex.ru	0%	Virustotal	Browse
api.ipify.org	0%	Virustotal	Browse
smtp.yandex.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe
http://smtp.yandex.com	0%	Avira URL Cloud	safe
http://crl.gl	0%	Avira URL Cloud	safe
http://smtp.yandex.com	0%	Virustotal		Browse
http://tempuri.org/DataSet1.xsd	0%	Virustotal		Browse
http://crl.gl	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.yandex.ru	77.88.21.158	true	false	0%, Virustotal, Browse	unknown
api.ipify.org	172.67.74.152	true	false	0%, Virustotal, Browse	unknown
smtp.yandex.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	IMG 003.exe, 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2914141071.0000000000435000.00000040.00000400.00020000.00000000.sdmp, aBYKwaZ.exe, 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/DataSet1.xsd	IMG 003.exe, aBYKwaZ.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.tiro.com	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.yandex.com	IMG 003.exe, 00000008.00000002.2918405791.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.000000000307B000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002C5B000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D53000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002BB7000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002D98000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	IMG 003.exe, 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2914163281.0000000000431000.00000040.00000400.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.gl	aBYKwaZ.exe, 0000000D.00000002.2915855945.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	IMG 003.exe, 00000000.00000002.1706447663.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, IMG 003.exe, 00000008.00000002.2918405791.0000000003001000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 00000009.00000002.1769731116.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, aBYKwaZ.exe, 0000000D.00000002.2918450759.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	IMG 003.exe, 00000000.00000002.1713530189.0000000007322000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	smtp.yandex.ru	Russian Federation		13238	YANDEXRU	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467967
Start date and time:	2024-07-05 07:15:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IMG 003.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 183 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:16:02	API Interceptor	1736487x Sleep call for process: IMG 003.exe modified
01:16:05	API Interceptor	46x Sleep call for process: powershell.exe modified
01:16:09	API Interceptor	941290x Sleep call for process: aBYKwaZ.exe modified
06:16:08	Task Scheduler	Run new task: aBYKwaZ path: C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.88.21.158	2024.scr.exe	Get hash	malicious	AgentTesla	Browse
	tWitaq427K.exe	Get hash	malicious	Remcos, AgentTesla	Browse
	gB49zgUhr8.exe	Get hash	malicious	AgentTesla	Browse
	RFQ Enqiury Requirement.pif.exe	Get hash	malicious	AgentTesla	Browse
	VfeC87R1r6.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.21357.32352.exe	Get hash	malicious	AgentTesla	Browse
	SIEMENS #2427021-S06564.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice AWB#7490327845.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice AWB#7490327845.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.yandex.ru	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	tWitaq427K.exe	Get hash	malicious	Remcos, AgentTesla	Browse	77.88.21.158
	gB49zgUhr8.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	RFQ Enqiury Requirement.pif.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	VfeC87R1r6.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	SecuriteInfo.com.Win32.PWSX-gen.21357.32352.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	SIEMENS #2427021-S06564.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice AWB#7490327845.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice AWB#7490327845.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
api.ipify.org	msupdate.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	msupdate.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	c2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	XX(1).exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Ship Docs_CI PL HBL COO_.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YANDEXRU	https://nmg.evlink21.net/	Get hash	malicious	Unknown	Browse	213.180.193.90
	http://adobefallshomes.com	Get hash	malicious	Unknown	Browse	77.88.21.119
	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	213.180.204.90
	tWitaq427K.exe	Get hash	malicious	Remcos, AgentTesla	Browse	77.88.21.158
	gB49zgUhr8.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	Ref-#47882327.docx	Get hash	malicious	HTMLPhisher	Browse	77.88.21.90
	https://9vn.lagerpec.com/N3pd9/	Get hash	malicious	HTMLPhisher	Browse	77.88.44.55
	http://pelicanbcnsolutions.com	Get hash	malicious	Unknown	Browse	87.250.251.119
	Complete with Docusign chelsea.pdf	Get hash	malicious	Unknown	Browse	77.88.55.88
CLOUDFLARENETUS	msupdate.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	msupdate.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	104.16.124.96
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	104.16.123.96
	c2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	6xmBUtHylU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	XX(1).exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OVER DUE INVOICE PAYMENT.docx	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AW0S.sdscondo.com/index.xml%23?email=cGV0ZXIuYnJvd24yM0Bxci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Ship Docs_CI PL HBL COO_.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	172.67.74.152
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	172.67.74.152
	c2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	XX(1).exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Ship Docs_CI PL HBL COO_.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://singingfiles.com/show.php?l=0&u=2156442&id=64574	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://sula.starladeroff.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\IMG 003.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aBYKwaZ.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\aBYKwaZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.3810236212315665
Encrypted:	false
SSDEEP:	48:lylWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMuge//ZmUyus:lGLHxv2IfLZ2KRH6Ouggs
MD5:	26F6E40F3C8972F2060C0201AD73BE4F
SHA1:	5F5B7154A29951D2BB6DD8E3E8C242A0EE7972BB
SHA-256:	82FFFB95FE80EDC9333F96C2051E2CA1C7A40DFA387059211394CB43E2CA5CEA
SHA-512:	F10D637941C0E617F9C46CA4AE5369B438F7BACFD7B8FC5C145F63F6ED6AD431E72BE4DE3E86EBA2FA0FFAEC2D1972C0EF35E862F2C2805B2EF703B0BCB349F9
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vem45lg.t4g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwpm1dt0.imr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebl22nai.0ne.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ld2svign.kwg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxg52aaw.l3b.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qvak2ews.kq2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdcq5x5s.e4t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ttongutp.2v3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp170F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\aBYKwaZ.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.115336295380733
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta3oxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTAIv
MD5:	D370BCD66336471A66D4495E3A48EFDB
SHA1:	AE54559396666D0ACF00D409777857E6948587B2
SHA-256:	720A248671D234CCB433EC06CC3D455389AC2BD23A69FADFE369D4D1F75BFCD2
SHA-512:	F2EB0C893CC4F466D407D73E79B1587442E1010FFEBCABA914298297BD61359980BBF46E8F470A348A4892525054BF1214026A5AEF43427AFB2FADD77531CB5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp

Download File

Process:	C:\Users\user\Desktop\IMG 003.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.115336295380733
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta3oxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTAIv
MD5:	D370BCD66336471A66D4495E3A48EFDB
SHA1:	AE54559396666D0ACF00D409777857E6948587B2
SHA-256:	720A248671D234CCB433EC06CC3D455389AC2BD23A69FADFE369D4D1F75BFCD2
SHA-512:	F2EB0C893CC4F466D407D73E79B1587442E1010FFEBCABA914298297BD61359980BBF46E8F470A348A4892525054BF1214026A5AEF43427AFB2FADD77531CB5F
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Download File

Process:	C:\Users\user\Desktop\IMG 003.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	816640
Entropy (8bit):	7.536750353028743
Encrypted:	false
SSDEEP:	12288:CIjofC1PERMhIdJJenzgfQCjU2E1JNcfWqnV66J3G3eVBT5NQ:z1FhwOzgfQgE1IuqV66JO0N
MD5:	605E5A50EBDEC57B636CFF6353684913
SHA1:	891D2BEEA2EDAA689CD3CFEDC1E30F4EC5DDE82E
SHA-256:	30225014A390133CD81A5896E070C88313E33C21C6CB40D9FEC1600BF9F70F4F
SHA-512:	617CB5975BAD1BD005770CB7FC5DF4FA39091367B73294043740450A031D1A55DB9C699FB2975EE1BC83F6648868FD5EF71B54608DE0A39E32115D0CA8DE5EE2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 41%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..l.............. ........@.. ....................................@.....................................O...................................Xa..p............................................ ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......h....s......T.......@^..........................................^..}.....(.......(.....z..}.....(.......(.......}....&..(.........0...............&......................0..+.........,..{.......+....,...{....o........(.......0..y........."...@"..PAs....( ......(!..... .... ....s"...(#.....r...p($......(%......(&.....r...po'............s(...()......(....^..}.....(.......(.........0............(....o+....8......(,......r!..p(-.......,..8.......p...%../.o......{..

C:\Users\user\AppData\Roaming\aBYKwaZ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\IMG 003.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.536750353028743
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	IMG 003.exe
File size:	816'640 bytes
MD5:	605e5a50ebdec57b636cff6353684913
SHA1:	891d2beea2edaa689cd3cfedc1e30f4ec5dde82e
SHA256:	30225014a390133cd81a5896e070c88313e33c21c6cb40d9fec1600bf9f70f4f
SHA512:	617cb5975bad1bd005770cb7fc5df4fa39091367b73294043740450a031d1a55db9c699fb2975ee1bc83f6648868fd5ef71b54608de0a39e32115d0ca8de5ee2
SSDEEP:	12288:CIjofC1PERMhIdJJenzgfQCjU2E1JNcfWqnV66J3G3eVBT5NQ:z1FhwOzgfQgE1IuqV66JO0N
TLSH:	8605F04532A49BE1FD6A57F9E460C6F003716D0AA855C33B2EC2FECB3972B11867452B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..l............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4c8be2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE8A28A03 [Sat Sep 5 05:17:55 2093 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8b8f	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc6158	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc6be8	0xc6c00	e29f7d3e92234e1f03ae90980719fd1c	False	0.8504716981132076	data	7.544396745144058	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x5bc	0x600	c98985921330f1f9a8f22aded582c13c	False	0.4225260416666667	data	4.104300294353814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	9b08ef98ec99a84e5ccf6501271f9baf	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xca090	0x32c	data			0.4248768472906404
RT_MANIFEST	0xca3cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 07:16:06.645823002 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:06.645862103 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:06.645976067 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:06.671715021 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:06.671727896 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.152152061 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.152223110 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:07.155541897 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:07.155550003 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.155780077 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.202991009 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:07.227982044 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:07.272500992 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.356863022 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.356929064 CEST	443	49733	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:07.357017994 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:07.374139071 CEST	49733	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:09.459686041 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:09.464596033 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:09.464695930 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:10.584470034 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:10.587207079 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:10.592169046 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:10.823252916 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:10.823616028 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:10.828567982 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.059576988 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.059978962 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:11.064922094 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.298016071 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.298049927 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.298069954 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.298084021 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.298126936 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:11.298186064 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:11.302378893 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:11.307224989 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.538945913 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.544137001 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:11.549007893 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.780375957 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:11.784775019 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:11.789730072 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.020739079 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.021004915 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:12.025834084 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.277724981 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.278126001 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:12.282948017 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.520529032 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.520895958 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:12.528255939 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.853861094 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:12.854052067 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:12.861092091 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:13.090122938 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:13.092075109 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:13.095568895 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:13.095590115 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:13.095618010 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:13.096980095 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:13.100398064 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:13.100569963 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:13.100579977 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:13.965934038 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:14.019639015 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:14.500122070 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:14.500166893 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:14.500222921 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:14.503264904 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:14.503281116 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:14.998265028 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:14.998336077 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:15.001409054 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:15.001420021 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:15.001727104 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:15.050894976 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:15.084996939 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:15.128546000 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:15.195883989 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:15.196144104 CEST	443	49737	172.67.74.152	192.168.2.4
Jul 5, 2024 07:16:15.196229935 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:15.198863029 CEST	49737	443	192.168.2.4	172.67.74.152
Jul 5, 2024 07:16:15.674561024 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:15.679502964 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:15.679615021 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:16.702056885 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:16.721348047 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:16.726229906 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:16.946852922 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:16.947052956 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:16.951944113 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.171231985 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.221769094 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:17.226752043 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.447793961 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.447863102 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.447916031 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.447933912 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:17.447966099 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.448002100 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:17.448004007 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.455459118 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:17.462774038 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.681920052 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.687081099 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:17.691991091 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.914653063 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:17.915050983 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:17.920173883 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:18.139811993 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:18.140222073 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:18.145153046 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:18.390039921 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:18.390352964 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:18.395169020 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:18.631418943 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:18.631747007 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:18.637264967 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.071397066 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.071706057 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:19.076553106 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.298450947 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.299403906 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:19.299484015 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:19.299514055 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:19.299540043 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:16:19.305641890 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.305655003 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.305757046 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:19.305767059 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:20.122410059 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:16:20.175946951 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:28.966291904 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:28.966370106 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:29.543426037 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:29.544332981 CEST	49736	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:29.545571089 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:29.548280954 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:29.549061060 CEST	587	49736	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:29.550334930 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:29.550436974 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:30.469408989 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:30.469540119 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:30.475780010 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:30.700001955 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:30.700248957 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:30.705530882 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:30.931294918 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:30.935101032 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:30.940125942 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.174397945 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.174413919 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.174427032 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.174520016 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.174525976 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:31.174575090 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:31.177843094 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:31.182626963 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.409161091 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.416352987 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:31.422157049 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.646806002 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.647346973 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:31.654357910 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.878294945 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:31.878648043 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:31.883502960 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.124866962 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.125050068 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.129803896 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.361342907 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.361679077 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.366552114 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.598424911 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.598622084 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.603395939 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.828702927 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.830235958 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.830389977 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.830462933 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.830517054 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.832009077 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.835088015 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.835094929 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.835153103 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.835182905 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.835287094 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.835325956 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.836782932 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.836786985 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.836802006 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.836807013 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.836834908 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.836854935 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.836877108 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.836894035 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.836927891 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.837162018 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.839843988 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.839848042 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.839873075 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.839876890 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.839895010 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.839934111 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.840357065 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.840395927 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.841639996 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.841697931 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.841697931 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.841753006 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.841789961 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.841831923 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.841887951 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.841926098 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.841979027 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.844862938 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.844866991 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.844877958 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.844942093 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.844969034 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.845380068 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.846631050 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.846699953 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.846708059 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.846720934 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.846754074 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.846788883 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.847879887 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:32.849456072 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849467039 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849500895 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849858999 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849863052 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849870920 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849912882 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849920988 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849924088 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.849932909 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850179911 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850224972 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850229025 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850231886 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850236893 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850307941 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850311995 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850320101 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850323915 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850387096 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.850390911 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852864027 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852873087 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852875948 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852884054 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852886915 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852895975 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852929115 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852932930 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852936029 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852938890 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852952003 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:32.852960110 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:33.888993979 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:33.941638947 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:35.119296074 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:35.119355917 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:35.509063959 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:35.510371923 CEST	49738	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:35.510370970 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:35.517499924 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:35.517508030 CEST	587	49738	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:35.517513990 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:35.525039911 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:36.347979069 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:36.348166943 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:36.355312109 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:36.570373058 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:36.570530891 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:36.575295925 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:36.792620897 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:36.793101072 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:36.797975063 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.016316891 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.016334057 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.016345978 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.016418934 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.016443968 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.016525030 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.018707037 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.023452044 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.241067886 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.245163918 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.250030041 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.467483044 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.469484091 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.474376917 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.691879034 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:37.740956068 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.953737020 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:37.958587885 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:38.215195894 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:38.225981951 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:38.231017113 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:38.458056927 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:38.461597919 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:38.466425896 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.200937033 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.201195002 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.206027031 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.423372030 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.425448895 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.425503969 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.425535917 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.425580025 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.427094936 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.430232048 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.430272102 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.430347919 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.430520058 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.430702925 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.430774927 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.431936026 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.431957960 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.431961060 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432010889 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.432020903 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432024956 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432034016 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432041883 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432063103 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432066917 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.432085037 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.432113886 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.435080051 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.435497046 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.435559988 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.436950922 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437057018 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437102079 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437123060 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.437156916 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437160969 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437194109 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.437221050 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.437289000 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437370062 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.437371016 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.440407038 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.440490007 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.440526962 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.440972090 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.442143917 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.442302942 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.442378044 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.442400932 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.442760944 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.442846060 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.442883968 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.442950010 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:39.442980051 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.443341970 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.445616961 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446831942 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446835995 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446933985 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446940899 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446945906 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446949005 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446952105 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446959972 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446965933 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446969986 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.446983099 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447410107 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447415113 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447423935 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447427034 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447436094 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447438955 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447443008 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:39.447707891 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:40.534339905 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:40.676012039 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:41.018491983 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:41.024138927 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:41.249388933 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:41.249569893 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:41.251077890 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:41.254678011 CEST	49746	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:41.260464907 CEST	587	49746	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:41.261076927 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:41.265882969 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:41.265973091 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.019661903 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.020107985 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.024965048 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.253034115 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.253473043 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.258264065 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.485774040 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.486371040 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.491240025 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.723740101 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.723839998 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.723850965 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.723862886 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.723872900 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.723908901 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.723953962 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.725675106 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.733916044 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.958499908 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:42.959877014 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:42.964674950 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.192451000 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.192677021 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.197510004 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.443454027 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.445168018 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.450212002 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.631709099 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.636518955 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.703119040 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.703413010 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.708204985 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.853975058 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.854228020 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.854284048 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.854573965 CEST	49747	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.856185913 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.859281063 CEST	587	49747	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.861515999 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.861593962 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.950855970 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:43.951159954 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:43.955951929 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.397013903 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.397288084 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.402031898 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.500670910 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.500896931 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.505722046 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.629703999 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.630022049 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.630103111 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.630131960 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.630183935 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.631565094 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.634793043 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.634844065 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.635072947 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.635077000 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.635112047 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636369944 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636451960 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.636451960 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.636548042 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636552095 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636599064 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.636642933 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636646032 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636707067 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.636733055 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636737108 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636785030 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.636795044 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636799097 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.636848927 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.639625072 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.639676094 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.642018080 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642075062 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.642179012 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642235041 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.642260075 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642333031 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.642448902 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642452955 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642513037 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.642784119 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642846107 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.642891884 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.642952919 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.643419027 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.644468069 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.644541979 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.647058010 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.647115946 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.647371054 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.647636890 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.647703886 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.648129940 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.648133993 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.648144007 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.648252010 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.648263931 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.649389029 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652091980 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652096033 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652239084 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652249098 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652292967 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652297020 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652478933 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652493000 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652501106 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652506113 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652512074 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652594090 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652636051 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652678967 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652725935 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652729988 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652777910 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652781963 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652841091 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652844906 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.652854919 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.732678890 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.732908964 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.737685919 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.964914083 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:44.965312958 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:44.970120907 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.199417114 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.199438095 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.199450016 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.199487925 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.199507952 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.199620962 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.202156067 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.207123995 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.434088945 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.452826977 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.457673073 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.649049044 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.684348106 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.684523106 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.689328909 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.860558987 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.860611916 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.917958021 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:45.918282032 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:45.924751997 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.168019056 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.168220997 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.173196077 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.410603046 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.410861015 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.415802002 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.650866032 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.651385069 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.656171083 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.883060932 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.885246992 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.885302067 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.885303020 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.885390043 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.888991117 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.890043974 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.890116930 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.890121937 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.890213013 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.890249014 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.890400887 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.893883944 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.893888950 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.893917084 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.893920898 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.893934965 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.893939018 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.893986940 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.894027948 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.894753933 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.894773960 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.894783020 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.894854069 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.894854069 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.894989967 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.895117998 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.895145893 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.895204067 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.898781061 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.898878098 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899004936 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899008989 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.899163961 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.899175882 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899209023 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899252892 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.899701118 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899815083 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899950981 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.899959087 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.899991989 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.900032043 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.900075912 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.900161028 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.903819084 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.903918982 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904035091 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904058933 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904103994 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:46.904107094 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904386997 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904448986 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904453039 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904530048 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904908895 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904913902 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904930115 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904958010 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904963017 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.904970884 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905041933 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905050993 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905056000 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905060053 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905062914 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905116081 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905119896 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905123949 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905128002 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905189991 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905199051 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905201912 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905205965 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905220985 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905225039 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.905232906 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908864021 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908880949 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908885002 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908895969 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908947945 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908951998 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.908955097 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.909037113 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.909050941 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.909054995 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.909065008 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.909077883 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:46.909086943 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:47.998079062 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:48.040887117 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:48.772979021 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:48.777935028 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.005388021 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.005409956 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.005678892 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:49.008980989 CEST	49749	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:49.008980989 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:49.014126062 CEST	587	49749	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.014209986 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.014463902 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:49.763520956 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.763647079 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:49.768791914 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.990175009 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:49.990335941 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:49.995238066 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.216536045 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.217329025 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.222953081 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450596094 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450649023 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450716019 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450860977 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450866938 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450874090 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.450916052 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.451050043 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.452963114 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.457721949 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.596970081 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.605283022 CEST	587	49750	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.608978987 CEST	49750	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.628993034 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:50.636957884 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:50.640991926 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.277471066 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.281153917 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.285962105 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.526583910 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.526710033 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.531497002 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.747647047 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.748136044 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.752897024 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.973794937 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.973814011 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.973828077 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.973872900 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.973890066 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:51.973938942 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.976438046 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:51.981161118 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.197395086 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.198630095 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:52.203538895 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.419789076 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.427381039 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:52.432322979 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.648237944 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.650969982 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:52.655808926 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.897032022 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:52.899338007 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:52.904186010 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.140990019 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.148451090 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.153342009 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.675168037 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.677361965 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.682246923 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.898107052 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.898478031 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.898529053 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.898593903 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.898648977 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.900448084 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.903439999 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.903455973 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.903465033 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.903476000 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.903492928 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.903522015 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.905829906 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905842066 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905848980 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905858040 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905874968 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905895948 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.905922890 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.905934095 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.905935049 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905945063 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.905976057 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.905987978 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.908869028 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.908880949 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.908921957 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.908936977 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.908966064 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.909004927 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.909141064 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.909181118 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.911720037 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.911751986 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.911781073 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.911799908 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.911808968 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.911819935 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.911844969 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.911890984 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.912018061 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.912061930 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.912061930 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.912117004 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.914474010 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.914518118 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.914836884 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.914891958 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.916981936 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917010069 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917043924 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.917067051 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.917190075 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917222023 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917237043 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.917259932 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.917335987 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917354107 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917387962 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.917387962 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:53.917407036 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917484045 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917498112 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917577028 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917622089 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917701960 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917743921 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917754889 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917779922 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.917876005 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.919318914 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.919605970 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.919614077 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.919626951 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.921592951 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.921606064 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.921684027 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.921693087 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.921755075 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922096014 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922105074 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922195911 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922204971 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922286987 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922296047 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922336102 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922411919 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922574997 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922583103 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922586918 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922595978 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922651052 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922765970 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922776937 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922786951 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922827005 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922837019 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922878027 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.922938108 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:53.923253059 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:55.051812887 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:55.267164946 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:55.267326117 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:59.384727001 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:59.390404940 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:59.629722118 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:59.629868031 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:59.629911900 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:59.630287886 CEST	49751	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:59.631901026 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:17:59.635093927 CEST	587	49751	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:59.636905909 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:17:59.636965036 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.357249022 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.362242937 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.530973911 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.531208038 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.538403034 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.589610100 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.589842081 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.590161085 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.591710091 CEST	49748	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.591711044 CEST	49753	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.596415043 CEST	587	49748	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.596541882 CEST	587	49753	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.596729040 CEST	49753	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.755697966 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:00.755922079 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:00.760991096 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.410150051 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.760478020 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.822448015 CEST	49753	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.924843073 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.925019026 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.926172972 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.926230907 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.926631927 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.926678896 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.926774025 CEST	587	49753	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.926917076 CEST	49753	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.926995993 CEST	587	49753	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.927027941 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.927042961 CEST	49753	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.927067995 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.931408882 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.931523085 CEST	587	49752	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.931554079 CEST	587	49753	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:01.931600094 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.931627989 CEST	49752	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:01.931638956 CEST	49753	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:02.664581060 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:02.669687033 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:02.669770002 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:02.814836025 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:02.820128918 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:02.820218086 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:03.399616957 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.399759054 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:03.404599905 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.563292027 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.563450098 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:03.568270922 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.632601023 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.632778883 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:03.637759924 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.794986963 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.796113968 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:03.803730965 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.856458902 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:03.856914043 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:03.861747980 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.029130936 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.029521942 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.034360886 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.082390070 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.082398891 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.082412004 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.082462072 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.082508087 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.082545042 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.085645914 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.090406895 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.264218092 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.264230013 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.264236927 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.264242887 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.264290094 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.266613960 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.272630930 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.309636116 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.310931921 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.315865993 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.498429060 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.502289057 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.507153988 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.534631014 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.541011095 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.545859098 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.733681917 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.734028101 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.738905907 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.764554024 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.764843941 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.769727945 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.965495110 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:04.969342947 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:04.974117041 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:05.010667086 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:05.013196945 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:05.018415928 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:05.215692997 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:05.255927086 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:05.286966085 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:05.379185915 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:05.605807066 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:05.610802889 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:05.929442883 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.097939014 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.234443903 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.241046906 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.354592085 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.359426022 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.764971972 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.765511990 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.765600920 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.765674114 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.765806913 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.765861988 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.766123056 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.766165018 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.768420935 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.769556999 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.770303965 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.770355940 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.770426035 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.770462036 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.770560980 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.770602942 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.773297071 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.773309946 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.773320913 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.773374081 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.773405075 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.773412943 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.773461103 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.775048018 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775060892 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775096893 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.775121927 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.775201082 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775245905 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.775249958 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775293112 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.775315046 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775327921 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775336981 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.775358915 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.775384903 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.776407003 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.776454926 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.778184891 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.778234959 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.778278112 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.778321981 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.778328896 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.778393030 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.779917002 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.779970884 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.780544043 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.780564070 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.780572891 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.780596018 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.780656099 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.781689882 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.781742096 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.783135891 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.783201933 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.783261061 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.783307076 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:06.783324957 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.784507036 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.784727097 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.784739971 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.785351992 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.785712957 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786475897 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786634922 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786653042 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786704063 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786717892 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786747932 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.786757946 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.787719965 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.787790060 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.787831068 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788059950 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788069963 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788089037 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788163900 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788172960 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788181067 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788209915 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:06.788228035 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.097626925 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.097819090 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.102587938 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.328919888 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.329309940 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.329408884 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.329464912 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.329541922 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.331322908 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.334162951 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.334203005 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.334208012 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.334228039 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.334336996 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.334445953 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.336508036 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336514950 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336524010 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336528063 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336534977 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336540937 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336549997 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336553097 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336561918 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.336569071 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.336599112 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.336618900 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.339091063 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.339137077 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341378927 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341438055 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341454983 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341500998 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341531038 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341551065 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341571093 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341609955 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341639996 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341660976 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341664076 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341706038 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341706038 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341721058 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341763020 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.341809988 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.341880083 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.343918085 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.343975067 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.346235037 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346302986 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.346333981 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346391916 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.346416950 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346421957 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346477032 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346477985 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.346512079 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346554041 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346560955 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:07.346605062 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346673012 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346734047 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346738100 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346815109 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346839905 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346892118 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346895933 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346976995 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.346981049 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348611116 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348800898 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348804951 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348845959 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348850012 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348905087 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348932981 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.348959923 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.350992918 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351001024 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351084948 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351089954 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351170063 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351182938 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351280928 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351284981 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351325989 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351377010 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351427078 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351439953 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351476908 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351531029 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351535082 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351541042 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351552010 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351596117 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351605892 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351638079 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351650953 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351695061 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.351699114 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.780601978 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:07.879153013 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:08.384778976 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:08.512439966 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:12.773236036 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:12.778155088 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.034291983 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.238590002 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.269222021 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.269303083 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.269439936 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.269752979 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.269953012 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.270015955 CEST	49754	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.270098925 CEST	49756	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.270811081 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.270826101 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.274519920 CEST	587	49754	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.274940014 CEST	587	49756	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.275016069 CEST	49756	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.500842094 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.500859976 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.500935078 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.501291990 CEST	49755	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.501482964 CEST	49757	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:13.506093025 CEST	587	49755	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.506406069 CEST	587	49757	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:13.506494999 CEST	49757	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:14.000184059 CEST	587	49756	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:14.051044941 CEST	49756	587	192.168.2.4	77.88.21.158
Jul 5, 2024 07:18:14.343214989 CEST	587	49757	77.88.21.158	192.168.2.4
Jul 5, 2024 07:18:14.394792080 CEST	49757	587	192.168.2.4	77.88.21.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 07:16:06.630248070 CEST	62018	53	192.168.2.4	1.1.1.1
Jul 5, 2024 07:16:06.637070894 CEST	53	62018	1.1.1.1	192.168.2.4
Jul 5, 2024 07:16:09.450048923 CEST	53453	53	192.168.2.4	1.1.1.1
Jul 5, 2024 07:16:09.457509995 CEST	53	53453	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 07:16:06.630248070 CEST	192.168.2.4	1.1.1.1	0x2b01	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 5, 2024 07:16:09.450048923 CEST	192.168.2.4	1.1.1.1	0x30c5	Standard query (0)	smtp.yandex.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 07:16:06.637070894 CEST	1.1.1.1	192.168.2.4	0x2b01	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 5, 2024 07:16:06.637070894 CEST	1.1.1.1	192.168.2.4	0x2b01	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 5, 2024 07:16:06.637070894 CEST	1.1.1.1	192.168.2.4	0x2b01	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 5, 2024 07:16:09.457509995 CEST	1.1.1.1	192.168.2.4	0x30c5	No error (0)	smtp.yandex.com	smtp.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 07:16:09.457509995 CEST	1.1.1.1	192.168.2.4	0x30c5	No error (0)	smtp.yandex.ru		77.88.21.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.74.152	443	7252	C:\Users\user\Desktop\IMG 003.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 05:16:07 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-05 05:16:07 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 05:16:07 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89e4e191794cc3f0-EWR
2024-07-05 05:16:07 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.67.74.152	443	7680	C:\Users\user\AppData\Roaming\aBYKwaZ.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 05:16:15 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-05 05:16:15 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 05:16:15 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89e4e1c29fc5c402-EWR
2024-07-05 05:16:15 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 5, 2024 07:16:10.584470034 CEST	587	49736	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-91.sas.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156570-9GR9A24IluQ0
Jul 5, 2024 07:16:10.587207079 CEST	49736	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:16:10.823252916 CEST	587	49736	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-91.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:16:10.823616028 CEST	49736	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:16:11.059576988 CEST	587	49736	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:16:16.702056885 CEST	587	49738	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-81.myt.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156576-GGRI7MFOpa60
Jul 5, 2024 07:16:16.721348047 CEST	49738	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:16:16.946852922 CEST	587	49738	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-81.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:16:16.947052956 CEST	49738	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:16:17.171231985 CEST	587	49738	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:17:30.469408989 CEST	587	49746	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-63.sas.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156650-UHR5SIRGfOs0
Jul 5, 2024 07:17:30.469540119 CEST	49746	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:17:30.700001955 CEST	587	49746	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-63.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:17:30.700248957 CEST	49746	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:17:30.931294918 CEST	587	49746	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:17:36.347979069 CEST	587	49747	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.klg.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156656-aHREhZ5XqGk0
Jul 5, 2024 07:17:36.348166943 CEST	49747	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:17:36.570373058 CEST	587	49747	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-45.klg.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:17:36.570530891 CEST	49747	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:17:36.792620897 CEST	587	49747	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:17:42.019661903 CEST	587	49748	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-45.myt.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156661-fHR1leLoFW20
Jul 5, 2024 07:17:42.020107985 CEST	49748	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:17:42.253034115 CEST	587	49748	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-45.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:17:42.253473043 CEST	49748	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:17:42.485774040 CEST	587	49748	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:17:44.500670910 CEST	587	49749	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-87.sas.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156664-iHR6f44WrqM0
Jul 5, 2024 07:17:44.500896931 CEST	49749	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:17:44.732678890 CEST	587	49749	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-87.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:17:44.732908964 CEST	49749	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:17:44.964914083 CEST	587	49749	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:17:49.763520956 CEST	587	49750	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156669-nHR4NBFsH4Y0
Jul 5, 2024 07:17:49.763647079 CEST	49750	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:17:49.990175009 CEST	587	49750	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:17:49.990335941 CEST	49750	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:17:50.216536045 CEST	587	49750	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:17:51.277471066 CEST	587	49751	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156671-pHRkNBFsKuQ0
Jul 5, 2024 07:17:51.281153917 CEST	49751	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:17:51.526583910 CEST	587	49751	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:17:51.526710033 CEST	49751	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:17:51.747647047 CEST	587	49751	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:00.530973911 CEST	587	49752	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-74.vla.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156680-0IR77dICV4Y0
Jul 5, 2024 07:18:00.531208038 CEST	49752	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:18:00.755697966 CEST	587	49752	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-74.vla.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:18:00.755922079 CEST	49752	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:18:01.924843073 CEST	587	49752	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:01.926172972 CEST	587	49752	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:01.926631927 CEST	587	49752	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:01.926774025 CEST	587	49753	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-81.vla.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156681-1IR7gv3wQmI0
Jul 5, 2024 07:18:01.926995993 CEST	587	49753	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-81.vla.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156681-1IR7gv3wQmI0
Jul 5, 2024 07:18:01.927027941 CEST	587	49752	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:03.399616957 CEST	587	49754	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156683-3IRLdV2DTeA0
Jul 5, 2024 07:18:03.399759054 CEST	49754	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:18:03.563292027 CEST	587	49755	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156683-3IRsA0SXwa60
Jul 5, 2024 07:18:03.563450098 CEST	49755	587	192.168.2.4	77.88.21.158	EHLO 585948
Jul 5, 2024 07:18:03.632601023 CEST	587	49754	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:18:03.632778883 CEST	49754	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:18:03.794986963 CEST	587	49755	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Jul 5, 2024 07:18:03.796113968 CEST	49755	587	192.168.2.4	77.88.21.158	STARTTLS
Jul 5, 2024 07:18:03.856458902 CEST	587	49754	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:04.029130936 CEST	587	49755	77.88.21.158	192.168.2.4	220 Go ahead
Jul 5, 2024 07:18:14.000184059 CEST	587	49756	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156693-DIRSa4KXrCg0
Jul 5, 2024 07:18:14.343214989 CEST	587	49757	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-42.klg.yp-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1720156694-EIRZ7b5VlqM0

Target ID:	0
Start time:	01:16:01
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\IMG 003.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IMG 003.exe"
Imagebase:	0xdd0000
File size:	816'640 bytes
MD5 hash:	605E5A50EBDEC57B636CFF6353684913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1709332299.000000000439E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:16:04
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IMG 003.exe"
Imagebase:	0x4a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:16:04
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:16:04
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aBYKwaZ.exe"
Imagebase:	0x4a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:16:04
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:16:04
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmpFDAB.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:16:04
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:16:05
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\IMG 003.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IMG 003.exe"
Imagebase:	0xc00000
File size:	816'640 bytes
MD5 hash:	605E5A50EBDEC57B636CFF6353684913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2918405791.000000000307B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2918405791.0000000003083000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2918405791.0000000003090000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2918405791.0000000003051000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:16:08
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Roaming\aBYKwaZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\aBYKwaZ.exe
Imagebase:	0x6e0000
File size:	816'640 bytes
MD5 hash:	605E5A50EBDEC57B636CFF6353684913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1772124355.0000000004564000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs Detection: 41%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:16:08
Start date:	05/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:16:11
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBYKwaZ" /XML "C:\Users\user\AppData\Local\Temp\tmp170F.tmp"
Imagebase:	0x2a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:16:11
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:16:12
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Roaming\aBYKwaZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\aBYKwaZ.exe"
Imagebase:	0x600000
File size:	816'640 bytes
MD5 hash:	605E5A50EBDEC57B636CFF6353684913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2918450759.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2918450759.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.2918450759.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	249
Total number of Limit Nodes:	22

Executed Functions

Function 0192AD52 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a9b8aa6823a70cc3e04c2f5ed05320cb378517ee925fb6937c44839634de6e
Instruction ID: d99393ef6eadf034a8cefa82927498a59d9963e053226bbbc860008d3f862345
Opcode Fuzzy Hash: 38a9b8aa6823a70cc3e04c2f5ed05320cb378517ee925fb6937c44839634de6e
Instruction Fuzzy Hash: 3BF01C7584D294CFCB81AF74D48C9E4B6B5BB57301B1414FBC40EAA616C6324A44CF14

Function 0175D271 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0175D2FE
GetCurrentThread.KERNEL32 ref: 0175D33B
GetCurrentProcess.KERNEL32 ref: 0175D378
GetCurrentThreadId.KERNEL32 ref: 0175D3D1

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b201ac2bbe11e2a75853c41f472c1dd24a51cd892b4d78fea9f03197c16a5ff1
Instruction ID: 87846e6aab276753221e524cf0761b5bf461d74e5a17576080ecf1aa4045c72c
Opcode Fuzzy Hash: b201ac2bbe11e2a75853c41f472c1dd24a51cd892b4d78fea9f03197c16a5ff1
Instruction Fuzzy Hash: C75164B09003498FDB68DFAAD588B9EFFF1FF88314F208059E409A72A1D7745984CB61

Function 0175D280 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0175D2FE
GetCurrentThread.KERNEL32 ref: 0175D33B
GetCurrentProcess.KERNEL32 ref: 0175D378
GetCurrentThreadId.KERNEL32 ref: 0175D3D1

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b2422a8b8b6063fbf68016a7d917af041c7cf84a14c3903c722956884c772c8f
Instruction ID: c50a5d0c9e362a0cbce74dec028a65f42c4e1995ba0c144e6cd250a658331077
Opcode Fuzzy Hash: b2422a8b8b6063fbf68016a7d917af041c7cf84a14c3903c722956884c772c8f
Instruction Fuzzy Hash: A15145B09007098FDB68DFAAD588B9EFBF1FF88314F208419E509A7391D7749984CB65

Function 0192746C Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 019276AE

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c49085e0b0294e260bab23caa840f57bd25201c54c4a7672c58fa88cc36896a3
Instruction ID: 55ad2e06e0d7e4816523ec736af931993d4656beefa96a060fc5e0c2847f7e78
Opcode Fuzzy Hash: c49085e0b0294e260bab23caa840f57bd25201c54c4a7672c58fa88cc36896a3
Instruction Fuzzy Hash: 85A16B71D0026A8FDF25CFA9C841BEDBBB6BF58310F1481A9D808B7294DB749985CF91

Function 01927478 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 019276AE

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fc855019cae1e842af5f10f441c4e58f3457bd12845f157ff4111788f4220110
Instruction ID: 7c374a66c4affb00ed57a3cc78af94b867c720a220d8800fcce22de0dfb419e8
Opcode Fuzzy Hash: fc855019cae1e842af5f10f441c4e58f3457bd12845f157ff4111788f4220110
Instruction Fuzzy Hash: 4F915A71D0026A8FDF25CFA9C841BEDBBB6BF58310F1481A9D808B7244DB749985CF91

Function 0175AFE8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0175B23E

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ec5a4219a06e194c05feb306e70df7c7527232efa924e7a3e48f72d363ed7ae4
Instruction ID: 3bab0bd6b4b6889e78c55bf4dcbc1a0a682fe35ba2176e52e187a0b9752ad407
Opcode Fuzzy Hash: ec5a4219a06e194c05feb306e70df7c7527232efa924e7a3e48f72d363ed7ae4
Instruction Fuzzy Hash: 8E811370A00B058FD7A4DF29D44476AFBF2FF88304F108A29D99AD7A50DBB5E845CB91

Function 0175590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017559C9

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5b929d781962ae1edcb1bfdb207c43c1e50f04274ddf83ef5ebc811e0241fde2
Instruction ID: 75f77f3e0d2f676a80768eaae2870b1070b52710163870e9f172af364cb4e1f6
Opcode Fuzzy Hash: 5b929d781962ae1edcb1bfdb207c43c1e50f04274ddf83ef5ebc811e0241fde2
Instruction Fuzzy Hash: 4D41B2B0C00719CADB24DFA9C984BDEFBF5BF89314F20816AD409AB251DBB56945CF90

Function 01755A84 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4152f1fc215185f3324b6cbfd9516b5d180e93167edcde8faa9d6d2a7c3393
Instruction ID: 1e9bbcf4dcdc517ad3bbcfa7a90859830441f3b335ad4ec2463f7d4db8c620b7
Opcode Fuzzy Hash: 2c4152f1fc215185f3324b6cbfd9516b5d180e93167edcde8faa9d6d2a7c3393
Instruction Fuzzy Hash: A331AEB5C04309CFDB51CBA9C88579DFFB1BF56314F14819AC809AB251C7BA6A49CF40

Function 01754514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017559C9

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 91e193b8be858c73d91ee754aa4a3d9c4466669e94fec592941d3f79799a3a20
Instruction ID: d5744e1de4a12cf75611d4d9fb41d91d49121194b9afb246baa4425f0a40103e
Opcode Fuzzy Hash: 91e193b8be858c73d91ee754aa4a3d9c4466669e94fec592941d3f79799a3a20
Instruction Fuzzy Hash: 5541B2B0C0071DCADB24DFAAC984B9EFBF5BF49314F20816AD409AB251DBB56945CF90

Function 019271E9 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01927280

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 52554b6ad957fb0e4c72c0a086189d08cb29e9e96f573533c5e1787043054a8f
Instruction ID: 8950aef3769f40628100dc2e2233e92a64e9f55ff092c793efa13b56a0666dd3
Opcode Fuzzy Hash: 52554b6ad957fb0e4c72c0a086189d08cb29e9e96f573533c5e1787043054a8f
Instruction Fuzzy Hash: E62155B19003498FDF14CFA9C885BEEBBF1FF48310F10842AE918A7241D7789944DBA0

Function 019271F0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01927280

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f0cd267828674e88c9588494c1199118f9e46a5807bdcd30267c014179ad7797
Instruction ID: b610a5f3864e51871017a9ea4596edbee5193d87444fe9909048211ee93a39e9
Opcode Fuzzy Hash: f0cd267828674e88c9588494c1199118f9e46a5807bdcd30267c014179ad7797
Instruction Fuzzy Hash: AB2127B19003599FDF14DFAAC885BEEBBF5FF48310F108429E959A7241C7789944CBA4

Function 019272D8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01927360

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e9c8e31be4a72f530c6ee07513d27d53399707daf77e2d70525a29a57efb27ea
Instruction ID: 45ffb3853c8ed6baf5cc722e130696a3c68e85d14931248d2fbf2a73767f1b58
Opcode Fuzzy Hash: e9c8e31be4a72f530c6ee07513d27d53399707daf77e2d70525a29a57efb27ea
Instruction Fuzzy Hash: 9C2136B18003599FCB14DFAAC885AEEFBF5FF48320F50842AE918A7250C7349941CBA4

Function 01926C18 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 01926C9E

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6b6525912cac8d0cd74491e73f0ac8c7a7624993affec2a95a4f19181b046f7e
Instruction ID: 06d873d1600f01d2c2bad183ee41fa4ef2d3dbd9f52efdf86dcddd2175667189
Opcode Fuzzy Hash: 6b6525912cac8d0cd74491e73f0ac8c7a7624993affec2a95a4f19181b046f7e
Instruction Fuzzy Hash: E92128B1D003098FDB14DFAAC4857AEFBF4EF88324F548429D959A7241CB789945CFA4

Function 0175D4C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0175D54F

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 55a035eca26370dd4cad5860a71757e4119ef751e5dcfa82d77cdc180d293c54
Instruction ID: de9de3b8800e66a4ca7a3d6b030bea3170dec955ec0616846ce61906209d77f5
Opcode Fuzzy Hash: 55a035eca26370dd4cad5860a71757e4119ef751e5dcfa82d77cdc180d293c54
Instruction Fuzzy Hash: 5C21DFB59003489FDB10CFAAD984AEEBFF4EB48324F24801AE918A3351D374A944CF60

Function 019272E0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01927360

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 03dce618dd3366eb936f945242df0bdb7734c487f2b308b43b6a6f20702a8e8c
Instruction ID: 6d02b589f5d6e15a509e53b11bef1425990affe0387baa708de8aab67d5f7cfe
Opcode Fuzzy Hash: 03dce618dd3366eb936f945242df0bdb7734c487f2b308b43b6a6f20702a8e8c
Instruction Fuzzy Hash: FC2128B18003599FCB14DFAAC885AEEFBF5FF48320F508429E959A7240C7349944DBA4

Function 01926C20 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 01926C9E

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1e8aa05c55dbbb4f2cbcee04fcbcff5851b5cf59ced885d2031bcb3ae9bccdbc
Instruction ID: cc1c290d44bf334a7a3ccaba93483d09bc34616fec86f50625ff7034198f2f1a
Opcode Fuzzy Hash: 1e8aa05c55dbbb4f2cbcee04fcbcff5851b5cf59ced885d2031bcb3ae9bccdbc
Instruction Fuzzy Hash: 23213871D003098FDB14DFAAC4857EEBBF4EF88324F148429D959A7241CB789945CFA4

Function 0175D4C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0175D54F

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 50944a8adc9b10b672a8b10cd401ed7368f02a2209ed6e00e04a6cecef55b324
Instruction ID: c34fc6a56aaeda47dc74e2f428a1c988afc777bd35e594144741e24615667137
Opcode Fuzzy Hash: 50944a8adc9b10b672a8b10cd401ed7368f02a2209ed6e00e04a6cecef55b324
Instruction Fuzzy Hash: 8021E2B59003489FDB10CFAAD884ADEFFF8EB48324F14801AE918A3350D374A944CFA0

Function 0192712C Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0192719E

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c18c28ca52ecb29171833d25d094e1398c9ba59678fd2d8616e0bc896684f55f
Instruction ID: e430dad84f35f49612b66973d62debd171c52d94f6fd71d6050c2ae7ad2667f2
Opcode Fuzzy Hash: c18c28ca52ecb29171833d25d094e1398c9ba59678fd2d8616e0bc896684f55f
Instruction Fuzzy Hash: 131156B18003489FDB14DFAAC845AEEFFF5EF88320F208419E919A7250C735A941CFA0

Function 0175AD08 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0175B2B9,00000800,00000000,00000000), ref: 0175B4CA

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 063ae2e2a2b231ed29c73e21deb89caf897cd04d9fe965ee848123450458cfd5
Instruction ID: 9ab0c879ade05f4b0ce98793980d6c9b697efb070ebf14368f879f73f257bebf
Opcode Fuzzy Hash: 063ae2e2a2b231ed29c73e21deb89caf897cd04d9fe965ee848123450458cfd5
Instruction Fuzzy Hash: FA1106B59003498FDB24CF9AC444AAEFFF5EB48310F10842ED919A7201C375A545CFA5

Function 01927130 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0192719E

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 38b3740341f613a075b722e0810eed0c6b1a01eb4847356e2be63826e92dea04
Instruction ID: 189dd23ac5e8a52fc94965dc6e731c6a5bc31de4a66416d871dc19db82f22c68
Opcode Fuzzy Hash: 38b3740341f613a075b722e0810eed0c6b1a01eb4847356e2be63826e92dea04
Instruction Fuzzy Hash: F81126719003499FDB14DFAAC845ADEBFF5EF88320F248419E519A7250C775A944CFA0

Function 0175B458 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0175B2B9,00000800,00000000,00000000), ref: 0175B4CA

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1cd490b325d3c740e2d629cc5f8ae8dd7c7ede6f825db90ad891e67b8676ebad
Instruction ID: 72421b9dcaeae1378903b44f3ecac025859140cc6fd40e9fc1016ccd52dbcba8
Opcode Fuzzy Hash: 1cd490b325d3c740e2d629cc5f8ae8dd7c7ede6f825db90ad891e67b8676ebad
Instruction Fuzzy Hash: C81114B68003498FDB24CF9AD844AAEFFF5EB88320F10852ED919A7200C775A545CFA5

Function 01926B6C Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 01926BD2

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f8a8e0c7dfd9181ebd7afd8a748bf0e74d5df36da2dd500dc09cef5d5d44c512
Instruction ID: db12abd166cefee549a6c6fec776970d1e4b8213ca5488dd93b2f8cd6d95a88c
Opcode Fuzzy Hash: f8a8e0c7dfd9181ebd7afd8a748bf0e74d5df36da2dd500dc09cef5d5d44c512
Instruction Fuzzy Hash: 011158B19003488FDB14DFAAC4457AEFFF4EB88324F20841AD519A7240CB35A944CF94

Function 01926B70 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 01926BD2

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a46fdb5a4d68f6c5ed4218e016e67cc03f934189c8230b7955caf664c554943a
Instruction ID: 96bde3637275b6c568e9f1bbf2faea4f2c96cf2406c7b975c1ca52d2a4a86b99
Opcode Fuzzy Hash: a46fdb5a4d68f6c5ed4218e016e67cc03f934189c8230b7955caf664c554943a
Instruction Fuzzy Hash: 14113AB19043488FDB14DFAAC4457DEFFF5EB88324F248419D559A7240CB75A944CF94

Function 01928498 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0192BA8D

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6a8bc027a7e1fc83bc95b9d3f07fa8a41e5c4fcfafa2824da083b2a7e4af688c
Instruction ID: 28fd7549e1ca51447f30ebd9885f2008161d553ed02b1c2a32ee4ec19f5b5356
Opcode Fuzzy Hash: 6a8bc027a7e1fc83bc95b9d3f07fa8a41e5c4fcfafa2824da083b2a7e4af688c
Instruction Fuzzy Hash: F51103B58003599FDB10DF9AD889BEEFFF8EB48320F108419E519A7200C375A944CFA1

Function 0192BA28 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0192BA8D

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bcc64c2a39ad30ca625aa78ecb9af84ff3f5dde23b7e3a56243f2d5f46c9ea6e
Instruction ID: 985a567fb434eb11e18bc7e8ae71e357adc0cf5df243ef85437ad44dc782f829
Opcode Fuzzy Hash: bcc64c2a39ad30ca625aa78ecb9af84ff3f5dde23b7e3a56243f2d5f46c9ea6e
Instruction Fuzzy Hash: F811F2B58003499FDB10DF99D889BEEFBF8FB48320F20851AE559A3210C375A944CFA1

Function 0175B1D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0175B23E

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9126aec1d259bcc72e7483def6e20555388fbb18863cb5a2dccfd122f5bd1a89
Instruction ID: bd250074b2f07edb50ee014c1f52580ceba03a5aa90320c67eca885217ecce03
Opcode Fuzzy Hash: 9126aec1d259bcc72e7483def6e20555388fbb18863cb5a2dccfd122f5bd1a89
Instruction Fuzzy Hash: A81110B5C003498FDB14CF9AD848AEEFBF5EF88320F10842AD929A7200C375A545CFA1

Function 0175B500 Relevance: 1.5, APIs: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0175B2B9,00000800,00000000,00000000), ref: 0175B4CA

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6feda6d6b38a2c71a3e8cd1d1580d73f69ad1b5b8bb507dd983f9753eb04c304
Instruction ID: 8e52e22dad9edfb0b9172df9d5ea9e9143fd47c8b44369379c8458dcbfb64207
Opcode Fuzzy Hash: 6feda6d6b38a2c71a3e8cd1d1580d73f69ad1b5b8bb507dd983f9753eb04c304
Instruction Fuzzy Hash: 2701DF768043448FDB218BADD8047EAFFF5EF99328F14805AD618D3651C7B69404CBA5

Function 0138D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704848282.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4899895b49fc9ef9d622cfdf72056805fdfd09550bb2465b5edc11123e87ed33
Instruction ID: e8b5bb61ccb0c8748eb56fce8f76ea7401d6b1d852428a02cdfaa43f29859a6b
Opcode Fuzzy Hash: 4899895b49fc9ef9d622cfdf72056805fdfd09550bb2465b5edc11123e87ed33
Instruction Fuzzy Hash: 072148B1504304DFDB01EF58D9C0B56BF65FB94328F20C56CD90A1B296C736E416C7A1

Function 0138D110 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704848282.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad541b2d64811702cd5fd41ebaab745d8b9e310de959f3407a35fbf2b15065d
Instruction ID: 94282158f2f71dfc52c12507d4f4aa52376f4a8c3cc0d4e66996be0ceb95bedd
Opcode Fuzzy Hash: 5ad541b2d64811702cd5fd41ebaab745d8b9e310de959f3407a35fbf2b15065d
Instruction Fuzzy Hash: 26212571604304DFDB45EF58D9C0B26BF66FF94328F24C569E90A0B286C336D816C7A1

Function 0139D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704879305.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c530ae9c8984d18ad1064a92e21026b61d4f2529c812090aa8addff9d1b1cb
Instruction ID: 18a8bfb844812836e36c2700f7fbf1badd01dd081c149e0d095022b351ced498
Opcode Fuzzy Hash: 92c530ae9c8984d18ad1064a92e21026b61d4f2529c812090aa8addff9d1b1cb
Instruction Fuzzy Hash: 35210071604204DFDF15DF68D885B26BBA5FB84358F20CA6DD80A0B386C33AD807CA61

Function 0139D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704879305.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb581740620567a8f65e2e9ebf274069c23f343b24d59295cc087671c7d87d4
Instruction ID: 0318d7a08b52e9be394970cfdad86ff97a777ed7afbbb2eb50f7edd136c13a2a
Opcode Fuzzy Hash: cfb581740620567a8f65e2e9ebf274069c23f343b24d59295cc087671c7d87d4
Instruction Fuzzy Hash: 6C21F5B5604204EFDF05DF98D9C5B25BBA5FB84328F24C6ADD94A4B392C336D406CA61

Function 0138D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704848282.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: dc7bf70595c95c456f849d93ad547c85f32cab151a5260809b8cebc97143736d
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: E011DF76504340DFDB02DF48D5C4B56BF72FB84324F24C2A9D9090B296C33AE45ACBA1

Function 0138D10B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704848282.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 1e59eb4a88f41bcdec6b840e9c224ea84893bb0286c8ca319b671f1c3d3d9e77
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 9111AC76504280CFDB16DF54D9C4B16BF72FB84328F24C6A9D9094B296C33AD45ACBA2

Function 0139D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704879305.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 4816f4c638177645ac744a736ab7c0b60d2cf517d2ada2d05d64a7370e28ea50
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 3411BB75904280DFDB02CF58C5C4B15BBB2FB84228F24C6ADD8894B296C33AD40ACB61

Function 0139D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704879305.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 881c61dc1eb2bf2cea9c27e73e052e5ceeca2b9fb8421044a5800dc083a393ad
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 2D118E75504280DFDB16CF58D5C4B15BB62FB44318F24C6A9D84A4B756C33AD44ACB61

Function 0138D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704848282.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e02e171154cfc9394e34a29d31b89485d27f801bf99f3a6830c19c12496692
Instruction ID: cbecc63cddd6721d3bfc97b85327830d66a56467f6c3b52c28efa7414fcd378c
Opcode Fuzzy Hash: 95e02e171154cfc9394e34a29d31b89485d27f801bf99f3a6830c19c12496692
Instruction Fuzzy Hash: 3501A7710043849AE7107F99DCC4B66BFE8DF51329F18C91AFD190A2C6C7799840C671

Function 0138D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704848282.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c348c7b2c4debcf5a507bf191a74d3825d96d3de2ff0f92d9a91a2968b51bc
Instruction ID: 72fc8906e60a82f792fc05e0faf487d79e81624bfe13e45aa51b87c813ffc970
Opcode Fuzzy Hash: 79c348c7b2c4debcf5a507bf191a74d3825d96d3de2ff0f92d9a91a2968b51bc
Instruction Fuzzy Hash: 30F062714043849EE7219F5ADCC8B62FFE8EF51635F18C55AFD084A2C6C379A844CAB1

Non-executed Functions

Function 0192DA68 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PHdq, xrefs: 0192DC53
PHdq, xrefs: 0192DD2B

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID: PHdq$PHdq
API String ID: 0-1995607813
Opcode ID: 70b139a3843b5672d03e3e4b046fbc94410d52fe09aa118b146529b1cd399d9d
Instruction ID: 61fc60d1804d86146f18feff1710f1cfd8ddf4d4f8c93de8857dbe2c829afccc
Opcode Fuzzy Hash: 70b139a3843b5672d03e3e4b046fbc94410d52fe09aa118b146529b1cd399d9d
Instruction Fuzzy Hash: 9CD1D474A00614CFDB18DFA9C598EA9B7F5BF8C301F2580A8E509AB365DB31AD40CF60

Function 01926348 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3638c148f29b3d906de42eba6ad82605c4f082134020b5710d8ec4ef7b0d35
Instruction ID: a0317f23804a215546fbf81dd6ff04c1272d8e7421d79fe5c2ea9c9cb9586070
Opcode Fuzzy Hash: 6d3638c148f29b3d906de42eba6ad82605c4f082134020b5710d8ec4ef7b0d35
Instruction Fuzzy Hash: B3E1FD74E011198FCB15DFA9C5809AEFBB2FF89305F248169D918AB759D730AD81CFA0

Function 01924430 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367d0744563f833116976f3ca2ee62c524e9b38bbdba5da552b61f92affd3bce
Instruction ID: 77ef0ea315f0264e88713bd5e6696faad8f4e5777b69f7c434884c752bd1c713
Opcode Fuzzy Hash: 367d0744563f833116976f3ca2ee62c524e9b38bbdba5da552b61f92affd3bce
Instruction Fuzzy Hash: 1BE10874E011198FCB15DFA8C5809AEBBB2FF89305F248169D418AB359D730AD81CFA1

Function 01924868 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c4f843ba5fb295fe677ba13dbdcefc687cfa488ae7b6d7532af8dd8378a2f6
Instruction ID: 40bac4f8ed5b77af98a8b025e1b8adf70e3451f10c924ff7829555d0c4437704
Opcode Fuzzy Hash: 55c4f843ba5fb295fe677ba13dbdcefc687cfa488ae7b6d7532af8dd8378a2f6
Instruction Fuzzy Hash: B3E1E974E011298FCB15DFA9C5809AEBBB2FF89305F248169D518AB359D730AD81CFA1

Function 01924CA0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce304f74343f2bfdf204f7f0618c78ddbcfdd4f886f505614e3518821aea1f45
Instruction ID: c29c257bddad79b7b157ca064894f5edbbe9fa86c9c6a7c02ba76929810ef058
Opcode Fuzzy Hash: ce304f74343f2bfdf204f7f0618c78ddbcfdd4f886f505614e3518821aea1f45
Instruction Fuzzy Hash: D0E11A74E011298FDB14DFA8C5849AEFBB2FF89314F248169D418AB359D734AD81CFA0

Function 01926CF8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d243ba4c6ae350bf6de9ce72481185369c1f9b5b358ee2c9e39199f4407f1dc9
Instruction ID: bb9ea01609e78f3258974463b9300d2be6c4eadb72448b20157890b2519941c6
Opcode Fuzzy Hash: d243ba4c6ae350bf6de9ce72481185369c1f9b5b358ee2c9e39199f4407f1dc9
Instruction Fuzzy Hash: AFE1FD74E011198FCB15DFA9C5809AEFBB2FF89305F248159D918AB35AD734AD81CFA0

Function 0175DDEC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705706055.0000000001750000.00000040.00000800.00020000.00000000.sdmp, Offset: 01750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1750000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e218b949754f4cfd1dddf9a7c79875172fdcd7db7fd1ea037c94c6438c2de481
Instruction ID: 383d7bc5d30558be099f379842f3f746d4b3862e0ad120167d833f4a4bd56a62
Opcode Fuzzy Hash: e218b949754f4cfd1dddf9a7c79875172fdcd7db7fd1ea037c94c6438c2de481
Instruction Fuzzy Hash: 0CA16032E0020ACFCF55DFB4C8445AEFBB2FF99300B15456AE905AB265DBB1E955CB40

Function 01926340 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705982138.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13cd0db95ff920f6915b21c3a21c1b63f725a840a18e9459907a008c6016dbb6
Instruction ID: d15c685e79ce95501ba4fc260988354e80e56b47d0defb3904df9f6343d4eafb
Opcode Fuzzy Hash: 13cd0db95ff920f6915b21c3a21c1b63f725a840a18e9459907a008c6016dbb6
Instruction Fuzzy Hash: 77510974E012298FDB15CFA9C5809AEFBF2FF89304F248169D858AB316D7309941CFA1

Analysis Process: IMG 003.exePID: 7252, Parent PID: 6676COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06CB30E0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06CB37DF
$dq, xrefs: 06CB3814
$dq, xrefs: 06CB382C
$dq, xrefs: 06CB3838
$dq, xrefs: 06CB37EB
$dq, xrefs: 06CB3808

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: e1d3eb387f8b4b95f62f4e9a683623e0301bce277e75f86663aba4903930b255
Instruction ID: c265a1a8f1b0f861c0bb44f2e09b2e402e83475513b0f25818a8faa3ea1a89d2
Opcode Fuzzy Hash: e1d3eb387f8b4b95f62f4e9a683623e0301bce277e75f86663aba4903930b255
Instruction Fuzzy Hash: 6A322F30E1075ACFCB14EF65C95459DB7B2FFC9300F20966AD40AA7264EB74AA85CB90

Function 06CBB283 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd6f3fcb951b3caf1574566e04d6df19e755decc14558b752639938c93aa516
Instruction ID: f62043df758e3682a08a6a01c5ba9453a03acc0eb3be3cf53facfe6cb9974410
Opcode Fuzzy Hash: 6cd6f3fcb951b3caf1574566e04d6df19e755decc14558b752639938c93aa516
Instruction Fuzzy Hash: 07124D70E102198BDF64DB68C4907EEB7B2FB49310F64952AE409EB391DE39DD81CB91

Function 06CB91A0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06CB9210
$dq, xrefs: 06CB924B
$dq, xrefs: 06CB9257
$dq, xrefs: 06CB921C

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 372418d608e28d239eebac85fdd21af02bf0b1461dd6a2a689f4e8dc5d9f8c81
Instruction ID: 155d6f3f929d7df2f1eeb1a7846074b8c100ebbf42f1116aada898eed844be65
Opcode Fuzzy Hash: 372418d608e28d239eebac85fdd21af02bf0b1461dd6a2a689f4e8dc5d9f8c81
Instruction Fuzzy Hash: BB915130F0021A9FDB54EF65D9507AEB7F6EF86200F108569D909EB384EA38DD428F91

Function 06CBCFA8 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06CBD3A3
$dq, xrefs: 06CBD39B
$dq, xrefs: 06CBD3AF

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq
API String ID: 0-2861643491
Opcode ID: 8f95561375ce95667c17342b7a820ab265b5837f61673b18927859984e97f5d4
Instruction ID: 1e5ebdc01d07dd9e58764114d4b4c1514aaada669d5471c9d38203ca3e175660
Opcode Fuzzy Hash: 8f95561375ce95667c17342b7a820ab265b5837f61673b18927859984e97f5d4
Instruction Fuzzy Hash: 43621070A002168FCB55EF68D590A9EB7F2FF84311F209968D40A9F359DB75ED86CB80

Function 06CB4BF0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fiq, xrefs: 06CB52FD
\Oiq, xrefs: 06CB4DA7
XPiq, xrefs: 06CB4D1D

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: fiq$XPiq$\Oiq
API String ID: 0-1639307521
Opcode ID: 20ac9ded7e955572fc152997a86784aef54cfb16a089b5a729d41c26d43536ab
Instruction ID: f71e4bb828559934581125d261c9b7f33fd3a70b01a5e3d784e7717d7dc57557
Opcode Fuzzy Hash: 20ac9ded7e955572fc152997a86784aef54cfb16a089b5a729d41c26d43536ab
Instruction Fuzzy Hash: B8619170F102099FEB54EFA5C8147AEBBF6FF88300F208429E506EB395DA759C458B90

Function 012FEB30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6o+p, xrefs: 012FEC37

Memory Dump Source

Source File: 00000008.00000002.2915924563.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12f0000_IMG 003.jbxd

Similarity

API ID:
String ID: 6o+p
API String ID: 0-2449111081
Opcode ID: 11eb4cfe106137b05a7cb340ff00d92f55eb751126ea4c55d487dd5e657ca5f3
Instruction ID: 9afd0126c14649ef68e9d0165e45c36ee23bd6c684a97cc6ba03e3bdb41ade77
Opcode Fuzzy Hash: 11eb4cfe106137b05a7cb340ff00d92f55eb751126ea4c55d487dd5e657ca5f3
Instruction Fuzzy Hash: E2415372D003498FCB01DFA9D8046EEBFF5EF99310F06816AE605A7291EB349845CBE1

Function 012FEC18 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 012FEC7F

Strings

6o+p, xrefs: 012FEC37

Memory Dump Source

Source File: 00000008.00000002.2915924563.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_12f0000_IMG 003.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: 6o+p
API String ID: 1890195054-2449111081
Opcode ID: b368a1f7165e7dbe519e2ee87c6268d604bfd5910f6a3334e0b5c711cc58a045
Instruction ID: b8c77504b50249ee8ceabd712db7a3d179c65e6de76a945e80e0f06f227ea870
Opcode Fuzzy Hash: b368a1f7165e7dbe519e2ee87c6268d604bfd5910f6a3334e0b5c711cc58a045
Instruction Fuzzy Hash: D31123B1C1025A9BCB10DF9AC544BDEFBF4EF48320F15812AE918A7240D378A944CFA5

Function 06CB9193 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06CB9210
$dq, xrefs: 06CB924B

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 959324cedeae625686d074c409751880bccd079ee16007f96e1ca63fb441cd04
Instruction ID: c533cf46c796e5fc062db4b8457b87d4ba22c5b7202b9667406b582e0229fb6c
Opcode Fuzzy Hash: 959324cedeae625686d074c409751880bccd079ee16007f96e1ca63fb441cd04
Instruction Fuzzy Hash: FD519230F002159FDB54EF74D950BAEB7F6EB89600F108539D90AEB394EA38DD428B91

Function 06CB80D0 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CB8115

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: 841d6dbd428574bda188eeeef53adb2012c56eddb571c39c8dab4c55084ff71c
Instruction ID: 0725b95e0cf2f9af6ae6bcb805efef90f6d7e0a554620cbcb8448a62ae4c0fd3
Opcode Fuzzy Hash: 841d6dbd428574bda188eeeef53adb2012c56eddb571c39c8dab4c55084ff71c
Instruction Fuzzy Hash: EA719E30B012158FDB54EF75C9546AE77AAFFC4200F149828D806EB394EB79ED82CB90

Function 06CB4BE7 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

XPiq, xrefs: 06CB4D1D

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: XPiq
API String ID: 0-3497805733
Opcode ID: 7ebd089087a9e7578586657fdd09c91e3c70fcba068863c556a6a6bb81c12ec5
Instruction ID: 5e20e45ffd9eefdf85d59b8c600dae4d06d9bc5709ff7edd11610e1fdf64c8eb
Opcode Fuzzy Hash: 7ebd089087a9e7578586657fdd09c91e3c70fcba068863c556a6a6bb81c12ec5
Instruction Fuzzy Hash: 59416170F102089FDB55DFA5C814BAEBBF6FF88700F208529E106AB399DA759C458B91

Function 06CBDB15 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06CBDC71

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: b26c2fcde8e8cba0e44aed2e5c2b244f4c90e746062dfeaaf368d5724a678767
Instruction ID: 7970eb763bcd0929499dad1d03ea15fc28949c25a8c2bbe5aa13e94e4d098b79
Opcode Fuzzy Hash: b26c2fcde8e8cba0e44aed2e5c2b244f4c90e746062dfeaaf368d5724a678767
Instruction Fuzzy Hash: 9941A170E007099FDB64DFA5D4546EEBBB2FF85300F204929E406EB240EB74EA46CB91

Function 06CB2290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06CB23CB

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: f8c19855e859d178004a531df631f8edd8bb1025a477436087e0732121cde677
Instruction ID: f94a958f86b5c5f944bdad6d52beec598b90c7668b50b0054ee6d5e3d9d234e6
Opcode Fuzzy Hash: f8c19855e859d178004a531df631f8edd8bb1025a477436087e0732121cde677
Instruction Fuzzy Hash: 6A31F230B002159FDB55AB74D5546BE7AE6AB89210F10942CE406EB384DE39DE42CBA1

Function 06CB80C7 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CB8115

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: 20d950ac9fb818c7040c03985bf4cdbfad8223ae98cbd7c33b7ddf40e6c8d80e
Instruction ID: 764bf5efaf0988b67dd662115a3c1aa24415ffa7205e74dcde6d053497a1c22f
Opcode Fuzzy Hash: 20d950ac9fb818c7040c03985bf4cdbfad8223ae98cbd7c33b7ddf40e6c8d80e
Instruction Fuzzy Hash: 14110132E02118DFDF649E65ED84AEEB7B9FB80311F18506AD912E7200C335DE42CBA0

Function 06CB38F8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

6o+p, xrefs: 06CB3922

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: 6o+p
API String ID: 0-2449111081
Opcode ID: ba80bc0894217ae3497c1b1e6cd5710965f9c912236cd3da589d8073ffa1ed39
Instruction ID: 986958a07e49229e86b05a45b3a2fc43ed72122666bb5e943f3b3414c9f8e7a1
Opcode Fuzzy Hash: ba80bc0894217ae3497c1b1e6cd5710965f9c912236cd3da589d8073ffa1ed39
Instruction Fuzzy Hash: 772137B1D01219AFCB00DF9AD884ADEFFB8FB48320F108229E518A7380C7746544CFA5

Function 06CB3900 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

6o+p, xrefs: 06CB3922

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: 6o+p
API String ID: 0-2449111081
Opcode ID: 457d22e38fd828028d70f74b865db1c5a53d525db6475d1831a2da00c503caf0
Instruction ID: 3b63ac597109051ae074a160dc298982bd0dc4a7ebfa0439df864aab8c719163
Opcode Fuzzy Hash: 457d22e38fd828028d70f74b865db1c5a53d525db6475d1831a2da00c503caf0
Instruction Fuzzy Hash: 5F11D0B1D01259AFCB10DF9AD984ADEFFB4FB48310F10812AE918A7340D378A954CFA5

Function 06CB5948 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9a4cf866365c0fe5a75d3a98869f6f6fdcfa2d3b8b5635f0da8e3df19aa10e
Instruction ID: c84a1c8003a969ae6b7136e8604e940718fcfa231c4d8475702e091cd94aba75
Opcode Fuzzy Hash: 1b9a4cf866365c0fe5a75d3a98869f6f6fdcfa2d3b8b5635f0da8e3df19aa10e
Instruction Fuzzy Hash: B3B1A271F002159BDF14EFA4D994AAE77B6FFC8310F609429D802AB394DA74ED46CB80

Function 06CBB28B Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ff5fc6f354d8e2c2789f0b3d43cfdf2effdb2774964de4f9baa2bb68d27eb3
Instruction ID: bb443aaee341413bc0a5306d9c969cf08d2d761e05475f7eef5900ff88523d55
Opcode Fuzzy Hash: b8ff5fc6f354d8e2c2789f0b3d43cfdf2effdb2774964de4f9baa2bb68d27eb3
Instruction Fuzzy Hash: 9FA16170F102198BEF64DBACC8907EE76A6FB89311F205429E509E7391CE39DD819B52

Function 06CBB6A0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03504774a899682416fbcf7334a2657950a8ab4ccc31d6c0df0970f68633ecaa
Instruction ID: 73d9a2b4689869c7a7f33b5ec1db7f00edbf22cb7fe0c60f9a3d012b4be83462
Opcode Fuzzy Hash: 03504774a899682416fbcf7334a2657950a8ab4ccc31d6c0df0970f68633ecaa
Instruction Fuzzy Hash: 00A15A30E102198FDFA4DF68C4807EDB7B1EB45310F24956AE409EB295DA35EE82CB91

Function 06CB6D70 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9429640f2afb09d455e2e237d813b32764dde413e638b88e131a41155eefb8ef
Instruction ID: e11c02de9a030dddc3c803173079bde3ef56e8baac21609b2d07c1704e697825
Opcode Fuzzy Hash: 9429640f2afb09d455e2e237d813b32764dde413e638b88e131a41155eefb8ef
Instruction Fuzzy Hash: F3A18C30A00254CFCB54EF69D548BADB7F2EF84315F149469E80AAB350DB36EE42CB90

Function 06CB6248 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45398ff950f76b5802ee91b4b4e12a36b369e7c2389910ee0db2c1d82afc188d
Instruction ID: 2b049c446fcba19d77ba6556ead9e05cbc678f36f45fcff9bf97adb2adbbbad1
Opcode Fuzzy Hash: 45398ff950f76b5802ee91b4b4e12a36b369e7c2389910ee0db2c1d82afc188d
Instruction Fuzzy Hash: 08618F71F001214BDF549A6EC8846AFAADAEFD5220F254439E80EDB364DE65ED4287C2

Function 06CB4327 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a0d8714cb9bc9d0ea844034229b3fd9bbc7475adfcf76c8cb62a9c8c171c4d
Instruction ID: 1cd46062644ff90de600c244bf086d1c29bf97a4b83f90f47808efce9dae609f
Opcode Fuzzy Hash: 74a0d8714cb9bc9d0ea844034229b3fd9bbc7475adfcf76c8cb62a9c8c171c4d
Instruction Fuzzy Hash: CA815030B042099FDB58DFA9D9547AE77F6EB89300F108538E40AEB399DA34DD428B91

Function 06CB464B Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15477a0bdd6f2d16f90868a63daa48a9089900b7443db38aafc8802028f1f04
Instruction ID: 5477f20a5254d92ce365377b0872dc5675263868df6c813cfcb3f8984616aa72
Opcode Fuzzy Hash: f15477a0bdd6f2d16f90868a63daa48a9089900b7443db38aafc8802028f1f04
Instruction Fuzzy Hash: 74914A30E102198BDF64DFA8C890BDDB7B1FF89310F208599D549AB295DB70AA85CB91

Function 06CB4321 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628caafd5ddd0ec297a64ad632b31deda45e5c5585cb27f829188a85764c00fc
Instruction ID: c99b469eb3797a6f17c3cef5f9aa4176685cdbf93c9bda74a88548d9b61d0e35
Opcode Fuzzy Hash: 628caafd5ddd0ec297a64ad632b31deda45e5c5585cb27f829188a85764c00fc
Instruction Fuzzy Hash: 1A814D30B046099FDB48DFA8D5547AEB7F2EB89300F108539D40AEB399DB34ED428B91

Function 06CBAF78 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b538f3c2ef7819c20048f0bffd6f2269ebbbe652fc1ca230fd99b745a1a166a1
Instruction ID: e9dce627890887066dcd24714f5d1c36cb7b807404489293cf05d6096aad4216
Opcode Fuzzy Hash: b538f3c2ef7819c20048f0bffd6f2269ebbbe652fc1ca230fd99b745a1a166a1
Instruction Fuzzy Hash: BB716B30E1031A8FDB15EFA9D5846AEB7B2FF85300F109529E41AAB354DF74ED468B80

Function 06CB4658 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cfd0eed49c775bb623b14175471c3e667af028d3376c7ff592c1a8a811b297
Instruction ID: c59e64a2affcf58e4ec250e5c886912b2e655ed805c4a301f0ca8956c8bcc0d9
Opcode Fuzzy Hash: b7cfd0eed49c775bb623b14175471c3e667af028d3376c7ff592c1a8a811b297
Instruction Fuzzy Hash: 5E913A30E102198BDF64DFA8C880BDDB7B1FF89310F208599D549AB295DB71AA85CB90

Function 06CBEB68 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b3d4546117673781b27ffee7efca8cdb9f342e618d39602ee7eb49214d8cae
Instruction ID: 4db8a988ff92b8a3113b22f1ab56c735aaa5e14a538c982827954da5cd3e14ff
Opcode Fuzzy Hash: 74b3d4546117673781b27ffee7efca8cdb9f342e618d39602ee7eb49214d8cae
Instruction Fuzzy Hash: 57715D70E002199FCB54EFA9D990AEEBBF6FF88300F149429E405AB355DA74ED46CB40

Function 06CBEB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df357d6390facb26ab2839056391de1673cecedfbfce8c46ff7e50b0c6d74fb
Instruction ID: c3afda66e1354ce7aaeff36b4fadf22b6b5548397ac6fec3e561e6be691ac86e
Opcode Fuzzy Hash: 9df357d6390facb26ab2839056391de1673cecedfbfce8c46ff7e50b0c6d74fb
Instruction Fuzzy Hash: 43714C70A002199FCB54EFA9D990AEEBBF6FF88300F14D429E005AB355DA74ED46CB50

Function 06CBFCD9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78aff25dae36b708a5cd61cfe45c6721922bcf1932fa5e01f7c3afe79d4d462c
Instruction ID: fd87f19a0b5d1c07f7ef97e283c352ad2889560c68d145e1c0721acf175aa382
Opcode Fuzzy Hash: 78aff25dae36b708a5cd61cfe45c6721922bcf1932fa5e01f7c3afe79d4d462c
Instruction Fuzzy Hash: D751BE31E001059FDB54EFB8E8946AEBBB2EB84315F20887DE126E7391DB358955CB80

Function 06CBFA88 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93974a953f8eacf265f7845f468fe63699a07bce616104542fb5eb37aaf0f51
Instruction ID: 4e688ac0baa5580b02aa0fa2cc343679f674f59ce759839602f1cbf58e5c8e70
Opcode Fuzzy Hash: e93974a953f8eacf265f7845f468fe63699a07bce616104542fb5eb37aaf0f51
Instruction Fuzzy Hash: 7A51C770B202149BEF646BBCDC547AE669AE789311F20043ED50AD7395CF2DCD815792

Function 06CB5628 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228ef4a3f7ff05c11cd07593614ee665cbf1746dbd91dbb8060a3349a117b408
Instruction ID: 36b5ac40a47539cf7413d3ab1460b5cf89d385ef64dcb46902e8f321f288966b
Opcode Fuzzy Hash: 228ef4a3f7ff05c11cd07593614ee665cbf1746dbd91dbb8060a3349a117b408
Instruction Fuzzy Hash: 8E518074F102058FDF60CF69C480ABEF7B2FB45310FA4996AD555EB281C674DA41CB91

Function 06CBFA98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6b6acff1630ebe8f0b346c2a66b6b79410acd13485650cb9a3dd2f36454231
Instruction ID: ed21e6df1e0c7aa1544ca382ca7bb240c5c086392dfe79b7d11d819053e6aa53
Opcode Fuzzy Hash: ca6b6acff1630ebe8f0b346c2a66b6b79410acd13485650cb9a3dd2f36454231
Instruction Fuzzy Hash: 6451A470B202145BEF646ABCDC547AF269AE789311F20443ED50AD3395CF6DCD815792

Function 06CBC840 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdc0718a9bbf0fe2b7f36a19785d023015f3bcf1df1972efb2502dd2928788b
Instruction ID: 9c97880a36cfaba48c2cbd0780c999c70abfc66794e8d927c8eef259b6759413
Opcode Fuzzy Hash: 4fdc0718a9bbf0fe2b7f36a19785d023015f3bcf1df1972efb2502dd2928788b
Instruction Fuzzy Hash: 0B516E74B102198FCB44EF79D890AAEB7F2FB84311F108579E506AB355DB39ED428B90

Function 06CB54A3 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea45c6e8814d2ce8ce2157a786eb248f6c62da5bd553a651b1c833e6a62a98a
Instruction ID: f0ebe406296dd99171d3dc34ac4476b74c29c60e82388f3abcf59829b6e588b9
Opcode Fuzzy Hash: 0ea45c6e8814d2ce8ce2157a786eb248f6c62da5bd553a651b1c833e6a62a98a
Instruction Fuzzy Hash: B6416A71E006098FDF70CEA9D880AAFF7F2EB84311F50492AE11AD7650D331E9498B95

Function 06CB5618 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5797f073035b37d1158fbabf9a4367343ab04240e1f3f9ff5df9977321434976
Instruction ID: 34c7b88e5e57880bfdbf7656fb84664b11a51bf8e3cc04c8a7598f3e1d6672e2
Opcode Fuzzy Hash: 5797f073035b37d1158fbabf9a4367343ab04240e1f3f9ff5df9977321434976
Instruction Fuzzy Hash: 0041A075E102058FDF61CF69C480ABEFBB2FB45310FA4D92AD559DB281C634DA41CB91

Function 06CB2140 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3bf9a6690177467f9300ab0a1eb70ef982ef4ac67814739eed4670955c1dc41
Instruction ID: b7d9726a84eca560b9865bccff2e2cc75f9b1a7ece6db31f4ee1a1fb250d7294
Opcode Fuzzy Hash: d3bf9a6690177467f9300ab0a1eb70ef982ef4ac67814739eed4670955c1dc41
Instruction Fuzzy Hash: BB318D30E102069BCB45DF65C854AAEBBF2EF8A310F148529E806EB350DB75EE42CB51

Function 06CB2150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be81109222d62b3428a1748364fe6fc35ad7c86b6960a83014794d02cdd205ef
Instruction ID: 8ba5e6e4622bb4be9d1697b1307a2ce41e134d40023f8b251a618b22310a626d
Opcode Fuzzy Hash: be81109222d62b3428a1748364fe6fc35ad7c86b6960a83014794d02cdd205ef
Instruction Fuzzy Hash: 11317C30E1020A9BCB49DF65C854AAEB7F2FF89310F108529E906EB354DB75EE42CB51

Function 06CB3B21 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7360569ba2bd6d224f2e1a7e53938c3c41a1d2dd3d3053b49a57b1f1f2590d
Instruction ID: 0913c823ced2b0373d75f1867b0896795d8b7e0312be9bacc47fde04be4948c7
Opcode Fuzzy Hash: 3b7360569ba2bd6d224f2e1a7e53938c3c41a1d2dd3d3053b49a57b1f1f2590d
Instruction Fuzzy Hash: 3A217C75F016159FDB10DF69E980AEEBBF5EB88710F008029E906E7294D739DD418BA0

Function 06CB3B30 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7989c31b538a64fceb6d31bfc6784ee9c7450b8a82aa2fd04e15d66cbb36a25
Instruction ID: 8dbd00fde23504a022ad9b7f35f1eeefcdd6a80fb2d63e7a232237c4a5f22c72
Opcode Fuzzy Hash: b7989c31b538a64fceb6d31bfc6784ee9c7450b8a82aa2fd04e15d66cbb36a25
Instruction Fuzzy Hash: C2219A35F006159FDB40DFA9D980AEEBBF5EB88610F108029E90AF7394E738DD408B90

Function 0129D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2915372348.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_129d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1458c3bba66408e1172087bcdf447146430324464590a834ed309235c759ce
Instruction ID: 2020f596387bb5d8549e01589761c4792a0d74b08da00a4898a47a200898ddc2
Opcode Fuzzy Hash: fb1458c3bba66408e1172087bcdf447146430324464590a834ed309235c759ce
Instruction Fuzzy Hash: 4C2104B1A142499FDF01DF5CD9C4B26BBA5FB84334F24C6ADD9090B243C37AD406DA61

Function 0129D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2915372348.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_129d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80204193becf15532f40f477c869ac38efe7cde0e00b76261b4357040cf11566
Instruction ID: cb82bf9490deeb1f8fea1c6e7d8b18a5297e02adf0c8743a20b7994ca84bd3f4
Opcode Fuzzy Hash: 80204193becf15532f40f477c869ac38efe7cde0e00b76261b4357040cf11566
Instruction Fuzzy Hash: A92125B16142089FCF11CF6CC9C4B26BBA5FB84314F20C96DE90A0B342C776D446DA61

Function 0129D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2915372348.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_129d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f846ebe21ed49da35730fae9c1a3a8c8c0401e95a48cfbf96b6290ccdf15c463
Instruction ID: dcc5712ab8f83c0851b8730daa190fb1cd194ca9ce129a5c4da2ed7ec36aaff0
Opcode Fuzzy Hash: f846ebe21ed49da35730fae9c1a3a8c8c0401e95a48cfbf96b6290ccdf15c463
Instruction Fuzzy Hash: 6D2122B5614208DFCF01DF5CD9C4B26BBA5FB84314F20CA6DE90A0B282C376E806DA61

Function 06CB6D6B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afca17a181cecc58ca7dc0eee7efd7c86c5e5283da8d4e83ada8a3a4e1124173
Instruction ID: 1ae8372df5c7aae85533cae0a52744996461a4e94efd7507f602c1d230da2102
Opcode Fuzzy Hash: afca17a181cecc58ca7dc0eee7efd7c86c5e5283da8d4e83ada8a3a4e1124173
Instruction Fuzzy Hash: 4F216030B101199FDF94DB69F9547EEB7B6EB84310F248429E805E7344D635DE428B90

Function 06CB30D7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b223a5313786946295911f1f1877edc14cf185990abbe9da78016d579727aaf0
Instruction ID: 3446d0115f1323f0ab513c53011a3c5d7d294bffd6ab2091e19d13581544d644
Opcode Fuzzy Hash: b223a5313786946295911f1f1877edc14cf185990abbe9da78016d579727aaf0
Instruction Fuzzy Hash: F411B171F002289FCB549B79DC405DEB7F9EB89310F14956AE10AEB244DA31DA45CBE1

Function 06CB3C40 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cea02b2ae04501e9f7dc9ccd8275acb03b95079d0b2d3fd928fed71b1a34fb4
Instruction ID: 26553de9634ddaa19918f5e9ca29cb7abe08ed92e077025c21aaebd62a31a5c0
Opcode Fuzzy Hash: 6cea02b2ae04501e9f7dc9ccd8275acb03b95079d0b2d3fd928fed71b1a34fb4
Instruction Fuzzy Hash: F7118E31B040289FDB44AAA8D8146EE77AAEBC8210F108139C90AE7344EE34DD028BD1

Function 06CB428B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce4c89a66000e9162efd97c590badc0dc2d29967a7bf49bd2a904157ca86622
Instruction ID: 935c260552a4e2f2c1a1ad467ac3ae7d9a0a29f0b00e65efaef85c5b8b651829
Opcode Fuzzy Hash: 2ce4c89a66000e9162efd97c590badc0dc2d29967a7bf49bd2a904157ca86622
Instruction Fuzzy Hash: EB018F34B145200BDB68AA6DD414B6FB7DAEBC9721F14C839F10BC7389D925DD424396

Function 06CBEDE9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8444d5de12575b8a051b5319c5da5f499ab5fc44b53273f139923d237b7ff9
Instruction ID: 0a5f173b7697ea11b284f7d1e1e221517012f93c5e6356b9329974d8f59b954d
Opcode Fuzzy Hash: ae8444d5de12575b8a051b5319c5da5f499ab5fc44b53273f139923d237b7ff9
Instruction Fuzzy Hash: 1F01DB31B141511FDB659A3D9850BEF77E6DBC9A60F14882EF10AC7341D925DE0243D5

Function 0129D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2915372348.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_129d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction ID: a171533176c77318c89cb9b9bf122baa22bc2f13da6acde461494cc8285e3377
Opcode Fuzzy Hash: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction Fuzzy Hash: E511DD76904288CFDB02CF58D5C4B16BB61FB84224F24C6AAD9490B647C33AD40ACBA2

Function 0129D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2915372348.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_129d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 69805ca80c5d969731ed1d6eff546fdeb8f68b61b7bf53a60f6a69141c827ef4
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: F411BB76504288CFDB12CF58C9C4B15BFA2FB84324F24C6A9D9494B292C33AD44ADB62

Function 0129D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2915372348.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_129d000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 620e8e1629dda16b38577a4faa38c71cf76c29ca3ffcecd28a55fc7ee28ad982
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 9711BE75504284CFDB02CF58D5C4B15BB72FB44214F24C6A9D9494B256C33AE40ADB51

Function 06CBA35B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cefc150925d83b606ed4dd37de1741387c450b8e683373fe597611a7af03415
Instruction ID: 26846bf6740e892a60dc5aa24942a56688188ededd84f07d1a21b7f3627995ee
Opcode Fuzzy Hash: 6cefc150925d83b606ed4dd37de1741387c450b8e683373fe597611a7af03415
Instruction Fuzzy Hash: 9801D470B142105FD761FA78D854BAF77D6DB86610F00882DF54BD7340DA29DD028391

Function 06CB3C37 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09d19610fe11b3e495d8006d627c3452a4fecd97c042c3a5d834ab0554c31d2
Instruction ID: b8a63d87552faf4ac287d8c415febd6bae8dc264f67940305ff527efdb907859
Opcode Fuzzy Hash: f09d19610fe11b3e495d8006d627c3452a4fecd97c042c3a5d834ab0554c31d2
Instruction Fuzzy Hash: 6501D631B140296BDB94AAA9DC106EF76EFDBC9610F004239D50BE7340EF64DD0647E2

Function 06CB4290 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489fc5ab24beddbc58a516098c40aaad1dda65e72fd1a4e9c1cda48e01e8c5b7
Instruction ID: 54fe72c7993ab7c6893177696091f28345104b2cd1ca84188d52d9533b59f82d
Opcode Fuzzy Hash: 489fc5ab24beddbc58a516098c40aaad1dda65e72fd1a4e9c1cda48e01e8c5b7
Instruction Fuzzy Hash: 9A01AD34B140200BDB68AAADD414B6FB3DAEBC8720F14C83EE10BC7349D925DC424385

Function 06CBEDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37c88e236addd56cc6f71fe3b7bec2e9d35266e9981338445896a7328565fb2
Instruction ID: af8441e09152ad7444400b2abff7b56cc039b6b1b6103648ede071df302c6a52
Opcode Fuzzy Hash: b37c88e236addd56cc6f71fe3b7bec2e9d35266e9981338445896a7328565fb2
Instruction Fuzzy Hash: 5501AF31B100110FDBA5AA6D9454BAFB3DADBC9A61F10883DF20AC7340DE29DD0243D5

Function 06CBC837 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc639472b606abf2546925d885ec950503ea2c3f6e3fdc0c791255f19b59474a
Instruction ID: 7dc607ae4d38bf772771d9217ed40ca4bd71dfcf4ba23fa5526905de77924fde
Opcode Fuzzy Hash: dc639472b606abf2546925d885ec950503ea2c3f6e3fdc0c791255f19b59474a
Instruction Fuzzy Hash: 2201A735B112249BDB549E69EC409DABB65F745310F004539F505E7340DA2A9D458BD0

Function 06CBA368 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aad5e9e4ed05de4ba07694a325cd2f825a6d27053ef1a788c4b91b5cb8a8c3b
Instruction ID: 55a161bb9743a8d1f1362ef713fa9eb1cb17dc4c93444a618e83498940e9f8eb
Opcode Fuzzy Hash: 5aad5e9e4ed05de4ba07694a325cd2f825a6d27053ef1a788c4b91b5cb8a8c3b
Instruction Fuzzy Hash: 7F018C70B101244FDBA0FAA8D554B6EB3D6EB8A611F108839E60BD7340EA29ED028794

Function 06CBFF41 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ebe7537bbb07d09da72f4dbc4b8a00821707cec4451319548672afbe0bf538
Instruction ID: ffc6050e87d3609187bee6dfed1dcf9afa36bfe9f62c716cf3346ead3c6642c5
Opcode Fuzzy Hash: 24ebe7537bbb07d09da72f4dbc4b8a00821707cec4451319548672afbe0bf538
Instruction Fuzzy Hash: 0DF090B0A002068FC750EF7CD8106AEBBF5EB88201F10417D8859E3315EB349D41CBA1

Function 06CBFF48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0cd6d962b7b89bc0bd93accd5a18a3ab65f04f77e312f07dfcf617cefbf834
Instruction ID: 7b7c1994bfd70d54ef4c9607988dfb4f196782c7131da92f5add6ab7892ca000
Opcode Fuzzy Hash: df0cd6d962b7b89bc0bd93accd5a18a3ab65f04f77e312f07dfcf617cefbf834
Instruction Fuzzy Hash: 9FF058B4A0020A8FC381EFBC89106AEB7F6EB88201F10417D8819D335AEE349D41CBA1

Function 06CB64D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbdb69ef567762cca4d1915de201342465e12913acd618594c24d250d70ea7b
Instruction ID: 68a10f6cd91057ae5630b5b169cc059ce3188255337f57564c94e97d2f9c4f4f
Opcode Fuzzy Hash: 1cbdb69ef567762cca4d1915de201342465e12913acd618594c24d250d70ea7b
Instruction Fuzzy Hash: C4E02631E1618867CF60CA75DD09BCFB79CD701204F2088A8E408C7201E572CF008BD1

Non-executed Functions

Function 06CB76F8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CB7819
$dq, xrefs: 06CB77E8
$dq, xrefs: 06CB7BA5
$dq, xrefs: 06CB7C50
$dq, xrefs: 06CB7BB1
$dq, xrefs: 06CB77F4
$dq, xrefs: 06CB7C44
$dq, xrefs: 06CB7C66
$dq, xrefs: 06CB7825
$dq, xrefs: 06CB7C5A

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3623093008
Opcode ID: f5159159f6c93ff451e5e3aa74210755ae126d63d5151734e85a8102e3665964
Instruction ID: e774f0ea6f24b1338999e09e2fa93fa2cdf6708e41957f41b4729bda93a8012e
Opcode Fuzzy Hash: f5159159f6c93ff451e5e3aa74210755ae126d63d5151734e85a8102e3665964
Instruction Fuzzy Hash: FB121B30E012198FDB64DF65D954AAEB7B2FF88301F20956DD80AAB355DB349E81CF90

Function 06CBA990 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CBAB4E
$dq, xrefs: 06CBAB18
$dq, xrefs: 06CBAB42
$dq, xrefs: 06CBAB0C
$dq, xrefs: 06CBAA92
$dq, xrefs: 06CBAA86
$dq, xrefs: 06CBAAE1
$dq, xrefs: 06CBAAED

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: 4d676ab789a6b875ca74ad84b49b31ae3f2876a5a472f04ea8151a358567878f
Instruction ID: 6fd67c227980abeb293a453771961380d43caf6396a05d47db7e7f2eae50d222
Opcode Fuzzy Hash: 4d676ab789a6b875ca74ad84b49b31ae3f2876a5a472f04ea8151a358567878f
Instruction Fuzzy Hash: 23918F70A10209DFDB64EFA9D954BAEB7B2FF44301F20942DE446A7290DB799E41CF90

Function 06CB70F8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CB7600
$dq, xrefs: 06CB7440
$dq, xrefs: 06CB7594
$dq, xrefs: 06CB7434
$dq, xrefs: 06CB760C
.5|q, xrefs: 06CB7153
$dq, xrefs: 06CB73DA

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: .5|q$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3447281907
Opcode ID: c991aba1617b13c553fb3b9dca3e25821149446865d9319ea98df5e5b9fcaeaf
Instruction ID: 79855120e4279aea67bce2807aad119406d757c06972329909116ef1e72bd93c
Opcode Fuzzy Hash: c991aba1617b13c553fb3b9dca3e25821149446865d9319ea98df5e5b9fcaeaf
Instruction Fuzzy Hash: 46F12E34B10219CFDB54EF69D554AAEB7B2FFC4301F208568D806AB395CB39AD42CB60

Function 06CBBA68 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CBBC01
$dq, xrefs: 06CBBC0D
$dq, xrefs: 06CBBC41
$dq, xrefs: 06CBBC69
$dq, xrefs: 06CBBC35
$dq, xrefs: 06CBBC75

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: ab278ebeba8e91157a7b9924ac81c785f429c2ddc95a2f80e22a185adab2c0da
Instruction ID: eafbd68061626f40b93f0e7eac92de1b09b9f848f8d79b4850e1777614fa94d0
Opcode Fuzzy Hash: ab278ebeba8e91157a7b9924ac81c785f429c2ddc95a2f80e22a185adab2c0da
Instruction Fuzzy Hash: 6B717F30E102198FDB68EF69D5406AEB7B2FF85301F205969D406AB244DF75AE42CB81

Function 06CB8428 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CB86E7
$dq, xrefs: 06CB86F3
$dq, xrefs: 06CB868E
$dq, xrefs: 06CB8682

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 20e319cfed1bdeb496195a702bc90992f496f7fa122ada3f75140ece9372e031
Instruction ID: 331a6a9777d536346a2fc4e0a6683b0b902ebfefd36c998623e7a4ba8e9144a6
Opcode Fuzzy Hash: 20e319cfed1bdeb496195a702bc90992f496f7fa122ada3f75140ece9372e031
Instruction Fuzzy Hash: F2B15C30A11219CFDB54EFA9C5506AEB7B6FF84301F249429D406EB394DB75DD82CB90

Function 06CB8840 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$dq, xrefs: 06CB88BF
$dq, xrefs: 06CB88CB
LRdq, xrefs: 06CB8933
LRdq, xrefs: 06CB8982

Memory Dump Source

Source File: 00000008.00000002.2935127801.0000000006CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cb0000_IMG 003.jbxd

Similarity

API ID:
String ID: LRdq$LRdq$$dq$$dq
API String ID: 0-340319088
Opcode ID: 13a32e25a85e8dc5f7626e699d0f68d40560b0f487137f33be0562e963492d92
Instruction ID: d64ed541a29e935c2ceddf1395422a7064baef21c391a380e23b26ee4632d2c7
Opcode Fuzzy Hash: 13a32e25a85e8dc5f7626e699d0f68d40560b0f487137f33be0562e963492d92
Instruction Fuzzy Hash: 0151CF30B012018FDB58EF28C950AAAB7F6FF88310F14956DE416AB395DB39ED41CB91

Analysis Process: aBYKwaZ.exePID: 7456, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	242
Total number of Limit Nodes:	26

Executed Functions

Function 0110D271 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110D2FE
GetCurrentThread.KERNEL32 ref: 0110D33B
GetCurrentProcess.KERNEL32 ref: 0110D378
GetCurrentThreadId.KERNEL32 ref: 0110D3D1

Strings

p, xrefs: 0110D3FD

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: Current$ProcessThread
String ID: p
API String ID: 2063062207-2678736219
Opcode ID: 2837a34c5afc32f42d858e4db9b74cddd817958625e29e9e8e3414247118bb65
Instruction ID: c709eb1e7af530c731c88215bf96745fd24efb08cbab6188b026e82f70007f23
Opcode Fuzzy Hash: 2837a34c5afc32f42d858e4db9b74cddd817958625e29e9e8e3414247118bb65
Instruction Fuzzy Hash: 555155B0D047498FDB18DFA9D548B9EBBF1EF88314F20C059E019A7390D7745988CB61

Function 0110D280 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110D2FE
GetCurrentThread.KERNEL32 ref: 0110D33B
GetCurrentProcess.KERNEL32 ref: 0110D378
GetCurrentThreadId.KERNEL32 ref: 0110D3D1

Strings

p, xrefs: 0110D3FD

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: Current$ProcessThread
String ID: p
API String ID: 2063062207-2678736219
Opcode ID: 84b10c13ee095265137458bcac8a62b464afa6c6f3267bf3d6168eb8f0206793
Instruction ID: c2a6a67b7ae21157dc21e90404803c1b7ad8be98492dd9d936142af0f8fd2996
Opcode Fuzzy Hash: 84b10c13ee095265137458bcac8a62b464afa6c6f3267bf3d6168eb8f0206793
Instruction Fuzzy Hash: 045145B09007098FDB18DFAAE548B9EBBF1EF88314F20C459E419B7390DB745984CB65

Function 0110AFE8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0110B23E

Strings

0O, xrefs: 0110B176
0O, xrefs: 0110B19B

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: HandleModule
String ID: 0O$0O
API String ID: 4139908857-234839962
Opcode ID: 17b4d907b66cf2fdfa730661f4fe5db89fcfd94273c328c6a8fcfba29b8b4361
Instruction ID: 9420ae5fc95300c36ec9ba9343e2195109a1a2cc57785671d6ef2cb24db42d93
Opcode Fuzzy Hash: 17b4d907b66cf2fdfa730661f4fe5db89fcfd94273c328c6a8fcfba29b8b4361
Instruction Fuzzy Hash: 3C714470A04B058FD729DF29E44476ABBF1FF88304F00892DD49AD7A84DBB5E945CB94

Function 0DCC746C Relevance: 1.8, APIs: 1, Instructions: 269
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0DCC76AE

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fda0a281b48840c15cf677408cec273ac671f0e0490aa547ef2c28f2cf829360
Instruction ID: 682e7a10e63d27c923177adc5db297a4d448a1ec6d8d78afd3613ed84e280992
Opcode Fuzzy Hash: fda0a281b48840c15cf677408cec273ac671f0e0490aa547ef2c28f2cf829360
Instruction Fuzzy Hash: 99A17BB1D0021D8FDB21DFA8C845BEDBBB2FF48314F148569D919A7280DB749A86CF91

Function 0DCC7478 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0DCC76AE

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c6f6a282a78d93041f8296e2d2f95ffa86724d8507493200cc813904a4cd3e4a
Instruction ID: fee73b8892686a9d20be9c74d9765591471e60a17c1e06f6bf361c92a46b2a8f
Opcode Fuzzy Hash: c6f6a282a78d93041f8296e2d2f95ffa86724d8507493200cc813904a4cd3e4a
Instruction Fuzzy Hash: 6C916B71D0061D8FDB25CFA8C841BEDBBB2FF48314F1491A9D919A7280DB749A86CF91

Function 01104514 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 011059C9

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5a4a45af3eafb1316c8e03c51845b5029bf40ac3825be6d2da9eadbc43aa73cb
Instruction ID: 8d05cb01e49d7d3a9a5905e81cd7184d6ff54b781ced6de4e8281146d6d47300
Opcode Fuzzy Hash: 5a4a45af3eafb1316c8e03c51845b5029bf40ac3825be6d2da9eadbc43aa73cb
Instruction Fuzzy Hash: 2B41E5B0C0071DCBDB29DFA9C94479EBBF6BF49304F208059D409AB291DBB56945CF91

Function 0110590C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 011059C9

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fb06de5ce444f9105eed02472cecd32b5a5fd0d64786311a834c2ceabd66bb97
Instruction ID: 85c8bf6cd5b881d88cc19799deeb477a78300ccfed62ceea172f7529bff18337
Opcode Fuzzy Hash: fb06de5ce444f9105eed02472cecd32b5a5fd0d64786311a834c2ceabd66bb97
Instruction Fuzzy Hash: C241D4B0C0071DCEDB29DFA9C98479EBBB6BF49304F24805AD409AB251DBB56945CF90

Function 0DCC71E9 Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0DCC7280

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: af83562a79381d0f1331c0a441569c6294d75e0e6843a1215b5b71f3de2b3458
Instruction ID: 6d94e42d7548d8535135cc866ed3989070a696b13fce9472a9de9921a0a83013
Opcode Fuzzy Hash: af83562a79381d0f1331c0a441569c6294d75e0e6843a1215b5b71f3de2b3458
Instruction Fuzzy Hash: 942146B5900309DFCB10CFA9C885BEEBBF5FF48310F14842AE959A7281C7789945CBA0

Function 0DCC71F0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0DCC7280

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 780cb0c975fe82a9e3c90c130dd948bb3871b338651161742946e63a106875d9
Instruction ID: c22ffd3f90dd05a038b8161d22f153d11acf79a683f990712ae578387489379c
Opcode Fuzzy Hash: 780cb0c975fe82a9e3c90c130dd948bb3871b338651161742946e63a106875d9
Instruction Fuzzy Hash: 0C2126B19003499FCB10DFA9C885BEEBBF5FF48310F148429E959A7281C7789954CBA4

Function 0DCC6C18 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0DCC6C9E

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f7e6223cb6f8b650ccbe8f117140bd15ed4227c2f996c9affe67668f4eb2efbd
Instruction ID: 8654be5106812e38c75f5b9bd5c6fbd9550237a9de05d2dc0a2a2f77f0553723
Opcode Fuzzy Hash: f7e6223cb6f8b650ccbe8f117140bd15ed4227c2f996c9affe67668f4eb2efbd
Instruction Fuzzy Hash: DD2157B1D003088FDB10DFA9C9857EEBBF4EF88324F14842AD519A7240CB789A45CBA0

Function 0DCC6C20 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0DCC6C9E

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4a8732732a053689f7440df239d1395cb05d1fc939dc55d9ef5a8bebea2992c2
Instruction ID: 21651c10ad80b0d734f4f8aafe7d93692a2954ed59b4175b61a647107820aa57
Opcode Fuzzy Hash: 4a8732732a053689f7440df239d1395cb05d1fc939dc55d9ef5a8bebea2992c2
Instruction Fuzzy Hash: 842168B19003088FCB10DFAAC4857EEBBF4EF88324F14842DD519A7240CB789945CFA4

Function 0DCC72D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0DCC7360

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e02658167cd6aa2444449ad05f00f36001d8aaab3d25a2bf393223a84b201742
Instruction ID: 66b0e4d60c551e106e00d71476a9513666c7f02b0477ae7ea27b7508b3051f67
Opcode Fuzzy Hash: e02658167cd6aa2444449ad05f00f36001d8aaab3d25a2bf393223a84b201742
Instruction Fuzzy Hash: A12125B1D003099FCF10DFA9C985AEEBBF5FF48320F54842AE959A7240D7389945DBA4

Function 0DCC72E0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0DCC7360

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e3a3cbca25e84970e8ecf5dd049e5dc29eac77f85ac75100dd9385795f5657e6
Instruction ID: bb9cf757683ec9e8941c5877b8e8f0317caf6106be8c112fa267d9902870097f
Opcode Fuzzy Hash: e3a3cbca25e84970e8ecf5dd049e5dc29eac77f85ac75100dd9385795f5657e6
Instruction Fuzzy Hash: 792148B18003099FCB10DFAAC884AEEFBF5FF48320F548429E919A7240C7389940CBA4

Function 0110D4C1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110D54F

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 39b7f32bc9889b2f462556e1ef2e6daee52657c2089f368c8d0653441a3ce534
Instruction ID: fa5037787fa86c24e6b700a2aa138affd305c6f7e788f57c9a63a5a70078bc9e
Opcode Fuzzy Hash: 39b7f32bc9889b2f462556e1ef2e6daee52657c2089f368c8d0653441a3ce534
Instruction Fuzzy Hash: C621E0B5D003089FDB14CFA9D984AEEBFF4EB48324F14801AE918A3350D379A944CF60

Function 0110D4C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110D54F

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 01d149713cd960795cb7716c0d1f015eda88ebd1d9315e76fc3f27d0bda87e59
Instruction ID: 0669b06509c7a9a1976b1ea8994d4dd469be84a03d37b2afdce4ce8b9c284da4
Opcode Fuzzy Hash: 01d149713cd960795cb7716c0d1f015eda88ebd1d9315e76fc3f27d0bda87e59
Instruction Fuzzy Hash: 9021E2B5D003089FDB10CFAAD984ADEBFF8EB48320F14801AE918A3350D375A944CFA0

Function 0110AD08 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0110B2B9,00000800,00000000,00000000), ref: 0110B4CA

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7618ff0ef327f3784fbe85702b05e689ae65ea9296743cb908ed6df36493b471
Instruction ID: 9f2de672321a72c44ec9bfcf47a8418e1a4d50c6c450013fd58303797fbc8229
Opcode Fuzzy Hash: 7618ff0ef327f3784fbe85702b05e689ae65ea9296743cb908ed6df36493b471
Instruction Fuzzy Hash: 461103B6D043098FDB24CF9AC444A9EFBF4EB88310F11842AD52AA7340C3B5A645CFA5

Function 0110B458 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0110B2B9,00000800,00000000,00000000), ref: 0110B4CA

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 253d68cd7938e837ed22ebd8e49b1f2df761a3244a6e006f43213153c9235e92
Instruction ID: 37c15ebaa615f5ce320649555806328c72e345eb8a0cf96936c00c464f42e5ab
Opcode Fuzzy Hash: 253d68cd7938e837ed22ebd8e49b1f2df761a3244a6e006f43213153c9235e92
Instruction Fuzzy Hash: 9611E7B6C003498FDB24CF9AD844ADEFBF4EB88320F15842ED559A7241C375A545CFA4

Function 0DCC7130 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0DCC719E

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d1e9010ccbf29b86fa0719d841f05d77e6174f31d8dd4dfdd1ef7db875346ae7
Instruction ID: 9ccfa4f67578664afe17fe2d66c99d61772ab1a2d32e773b18c32f2062aed507
Opcode Fuzzy Hash: d1e9010ccbf29b86fa0719d841f05d77e6174f31d8dd4dfdd1ef7db875346ae7
Instruction Fuzzy Hash: 211126B19002499FCB20DFAAC845ADEBFF5EB88324F148419E919A7250CB75A944CFA1

Function 0DCC712A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0DCC719E

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 45ec0f4a136cc31977acdd1cf46321901e2feda58945ff558041b8346a7e6a9a
Instruction ID: f11c46fbb7215a7b05ea3b963d9727890c94bb6b90fdf1f6b94233355b52b3b2
Opcode Fuzzy Hash: 45ec0f4a136cc31977acdd1cf46321901e2feda58945ff558041b8346a7e6a9a
Instruction Fuzzy Hash: 491167B68002098FCF10DFAAC8457EEBBF5EF48320F14841AD519A7250C7359541CFA0

Function 0DCC6B68 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0DCC6BD2

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 01874f7b636f38e6a9db8de663d74cb49538695d6617c44a8deae97302ffb346
Instruction ID: ac9006bf817d448b7515b7cb8d070cfa204bf46a311ca1cb76bf7301ce34c2ee
Opcode Fuzzy Hash: 01874f7b636f38e6a9db8de663d74cb49538695d6617c44a8deae97302ffb346
Instruction Fuzzy Hash: 54116AB5D003088FCB24DFA9C9457EEFBF4AF88324F24841AC519A7340CB34A545CB91

Function 0DCC6B70 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0DCC6BD2

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 70fd2d7ae0555fa1aedc7ea9d4bcd97424b42bcad47eaca116a76bd80cd2ad20
Instruction ID: 76fb496fec0c3d65d122fdf23514e50d4f4719bf6821911affa9c635d79fbb28
Opcode Fuzzy Hash: 70fd2d7ae0555fa1aedc7ea9d4bcd97424b42bcad47eaca116a76bd80cd2ad20
Instruction Fuzzy Hash: 9B113AB19003488FCB24DFAAC4457DEFBF5EF88324F248419D519A7240CB75A945CB95

Function 0DCC8368 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0DCCACED

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 548ab12a22c5a1bfadad58d5ff96ee9309cf789f77b83425287b5325eb9651d8
Instruction ID: bea7d84051c756a30112442596c6afa42bb4eff919ee3b2fef7cae8870222279
Opcode Fuzzy Hash: 548ab12a22c5a1bfadad58d5ff96ee9309cf789f77b83425287b5325eb9651d8
Instruction Fuzzy Hash: E911F2B580034C9FDB20DF9AD989BDEBBF8FB48320F108419E919A7200D375A944CFA5

Function 0110B1D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0110B23E

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fe7e8207e2b9ffbdcc0a8e60d5ae1328396029702b12804c0cbbf70dadb56dfc
Instruction ID: 0136d262b7cc9f0a8dbd431ffb3504e45a7ca0836bcdfbdc290b0ca398b429f1
Opcode Fuzzy Hash: fe7e8207e2b9ffbdcc0a8e60d5ae1328396029702b12804c0cbbf70dadb56dfc
Instruction Fuzzy Hash: F71110B5C003498FDB24DF9AD844ADEFBF4EF88324F10841AD929A7240C3B9A545CFA5

Function 0DCCAC88 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0DCCACED

Memory Dump Source

Source File: 00000009.00000002.1778976336.000000000DCC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0DCC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_dcc0000_aBYKwaZ.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bc0fe04e004c1f7b205fbb4bf5dcdfcc9ac3e961a1d06b7d5e060ef1fe4e7797
Instruction ID: ae794090d993802c1ddbf0b0cc1d33bd87899e7250605d407f9970b957265b90
Opcode Fuzzy Hash: bc0fe04e004c1f7b205fbb4bf5dcdfcc9ac3e961a1d06b7d5e060ef1fe4e7797
Instruction Fuzzy Hash: 891103B5800308CFCB10DF99D989BDEBBF4EB48310F14840AD518A7700D375A545CFA1

Function 0110B500 Relevance: 1.5, APIs: 1, Instructions: 44libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0110B2B9,00000800,00000000,00000000), ref: 0110B4CA

Memory Dump Source

Source File: 00000009.00000002.1768828676.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1100000_aBYKwaZ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 491077401cbc5e057bc4cf7f0821b4e54c19d8f47d62ade6873085ac6fbdb608
Instruction ID: c1499fee68d2c28536828165bb98862ba1367624bf580dd8fd2ffe826ae82af8
Opcode Fuzzy Hash: 491077401cbc5e057bc4cf7f0821b4e54c19d8f47d62ade6873085ac6fbdb608
Instruction Fuzzy Hash: A701B176C043048FDB258BACD4047EABBF4AF95324F14805AE159D3651C3B59404CB64

Function 00E6D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768103928.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e6d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e281dc1a0e71e72314fc07ffee557c63ff265bb9e4ad5a7ad032a59498d4d1
Instruction ID: 57f2b47c3b7c6bd4b9668dbf1d4650254db3b33421d83e33370bbac2653d6c25
Opcode Fuzzy Hash: c5e281dc1a0e71e72314fc07ffee557c63ff265bb9e4ad5a7ad032a59498d4d1
Instruction Fuzzy Hash: EF2145B1A48340DFCB01DF14ECC0B26BF65FB98368F64C569E80A1B656C336D816CBA1

Function 00E6D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768103928.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e6d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4a56f98c55fd6bf5edd7c46b28fef552618df2f5255d983d0bad1c013aae42
Instruction ID: 6d7eca0f5b65b1aac5dc6f77c6bdeba57b72bd929ffce056dd7bae497158d166
Opcode Fuzzy Hash: 5e4a56f98c55fd6bf5edd7c46b28fef552618df2f5255d983d0bad1c013aae42
Instruction Fuzzy Hash: 062148B1A48244DFCB01DF04EDC0B16BF65FB98364F64C568D80A5B246C736EC16C7A1

Function 00E7D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768140009.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e7d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8283876b197712250ecf5f1adb7665e2df8c078843be792917f0b00dce9b5ceb
Instruction ID: da078cddc29ec6f78a90a14a9be1a94fa78b394009323b7734dff96b5c43f4d8
Opcode Fuzzy Hash: 8283876b197712250ecf5f1adb7665e2df8c078843be792917f0b00dce9b5ceb
Instruction Fuzzy Hash: D9210371608240AFCB01DF14D9C0B25BBB5FF84318F24C66DD80E5B2A2C336D807CA61

Function 00E7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768140009.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e7d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e994a99f95efea022f6c3127234e03bdd32a3b9a83875172e89a5563496caf
Instruction ID: 6fda4ab7a621f543fb9c21bae6b159bae872dc6942a8ec307bd3dec4498568a6
Opcode Fuzzy Hash: 60e994a99f95efea022f6c3127234e03bdd32a3b9a83875172e89a5563496caf
Instruction Fuzzy Hash: 7921D075608200DFCB15DF14DD84B26BBB6EF94318F24D96DD80E5B286C33AD807CA61

Function 00E7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768140009.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e7d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d2078ca6a3c5067efd91f660db315a6336008d09b41b90b142be978c12eb82
Instruction ID: eec07417229793456d1267a23744facf04f6b76b169be1bc768f6720de77c2a2
Opcode Fuzzy Hash: 82d2078ca6a3c5067efd91f660db315a6336008d09b41b90b142be978c12eb82
Instruction Fuzzy Hash: BB21507550D3808FDB12CF24D994715BF72EF46314F28C5EAD8498B6A7C33A980ACB62

Function 00E6D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768103928.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e6d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: a91b48f83896287b7793601367646511ba5cf77b95457b9d703aee6f634995be
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: E411E976944280CFCB15CF14D9C4B16BF71FB94328F24C5A9D8464B656C336D856CB91

Function 00E6D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768103928.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e6d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: d64b5292215395ea09e261129f6013b01194202bd7d9b16a9e5f3e3f3734a1a2
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 42112676A44240CFCB12CF00D9C4B16BF72FB94324F24C2A9D8094B256C33AE85ACBA1

Function 00E7D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768140009.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e7d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 96f3a32c455be0db4914a6bd3de91a6c23047b54c60de73055c96f113ee161fc
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 9211BE75508280DFCB01CF50C9C4B15BB71FF84328F24C6ADD8494B2A6C33AD81ACB61

Function 00E6D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768103928.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e6d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784899d2b20e03ebd9e3e233da4e830740ad9b7a4587abb200c1ec660414f5d5
Instruction ID: 0f5c0a3e1c29118f6f39d99cfa8407c837639937e496f52810ad7a61d82f5edf
Opcode Fuzzy Hash: 784899d2b20e03ebd9e3e233da4e830740ad9b7a4587abb200c1ec660414f5d5
Instruction Fuzzy Hash: 5E01F771A4C3449AE7208A15EC84B66BFD8DF61369F58C81BEC091A286C739A840C672

Function 00E6D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1768103928.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e6d000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef23b2c6b4af78f1aa312eb7086c1f13c26b9a90b70e70236b9028ce7cfd20db
Instruction ID: 02aeef496bfd16b552364d547130cc2e5adf76da74ee6c152a7e61d4fa151a6d
Opcode Fuzzy Hash: ef23b2c6b4af78f1aa312eb7086c1f13c26b9a90b70e70236b9028ce7cfd20db
Instruction Fuzzy Hash: CAF0C2315083449EE7208E06DC84B62FFA8EF51778F18C45AED085A286C379A840CAB1

Analysis Process: aBYKwaZ.exePID: 7680, Parent PID: 7456COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	6

Executed Functions

Function 066B30E0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066B382C
$dq, xrefs: 066B37DF
$dq, xrefs: 066B3838
$dq, xrefs: 066B3808
$dq, xrefs: 066B3814
$dq, xrefs: 066B37EB

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: d9162c75e54b666290f6691c6ff8bd5f07f277d42cdd2f937f88d1c62d08bcea
Instruction ID: 5e37fb55f368df647ec8d889aac96c52be1b9a993e60437e1f809fadf8bd027c
Opcode Fuzzy Hash: d9162c75e54b666290f6691c6ff8bd5f07f277d42cdd2f937f88d1c62d08bcea
Instruction Fuzzy Hash: 7E321E31E10619CFCB54EF65C85459EB7B2FFC9300F219669D449A7364EB30AA85CB90

Function 066B7DD8 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066B8115
$dq, xrefs: 066B8121

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 39d9a9cb107ad337e5ddabfb28723b5043f81b40f4126ae2968bf2cd2377c1df
Instruction ID: e2d61cfe7ce3afec7bca4a74436412de8df1294549f3dde9b6f80ca2e52d00e7
Opcode Fuzzy Hash: 39d9a9cb107ad337e5ddabfb28723b5043f81b40f4126ae2968bf2cd2377c1df
Instruction Fuzzy Hash: 3602AD30B01215DFDB54DF68D990AAEB7E6FF84311F249929E4069B395DB31ED82CB80

Function 066B2408 Relevance: 1.0, Instructions: 1012COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a632ac3de05da5c28c4414c0c3a41bbd00e30883448e036f909133f62e5231ba
Instruction ID: 49a5bb943f686bd584edc3117e6287fe41638c5946078a1d5ad4aea73b14aeac
Opcode Fuzzy Hash: a632ac3de05da5c28c4414c0c3a41bbd00e30883448e036f909133f62e5231ba
Instruction Fuzzy Hash: F3924734E00204CFDB64DB68C5A8AADB7F6FF45314F5494A9D40AAB365DB35ED82CB80

Function 066B6648 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b2d0b5759123463d95d9c7f47825a4291f355de76f97b15a5ad0d015866283
Instruction ID: 9a433b84eb65fe7693e55c606f28e3ca414556aa004e7fd4f36572aae2c50e04
Opcode Fuzzy Hash: a9b2d0b5759123463d95d9c7f47825a4291f355de76f97b15a5ad0d015866283
Instruction Fuzzy Hash: 1762AC34A00215DFDB54DF68D594AADBBF2EF88314F249469E40ADB394DB31ED82CB80

Function 066BC1E8 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7474366d36a8db5dc74fcf1affb4a356001e6bd0763f75d1765ff2d98885ed70
Instruction ID: ce12369551da65012285b9bd559369b6817f16273b7c296c7da4cdfc9ef80b54
Opcode Fuzzy Hash: 7474366d36a8db5dc74fcf1affb4a356001e6bd0763f75d1765ff2d98885ed70
Instruction Fuzzy Hash: 57326134B00215DFDB54DF68D890BAEB7B2FB88310F109529E50ADB355DB35ED828B90

Function 066B5628 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339bf0eb5f6bd763675b656cf29553fd3320f36d718162416a28d46bcae52b3d
Instruction ID: 26134a0e8a749a90da14fc3157bb5a80786c1f61c8633529d42186b11d9bed14
Opcode Fuzzy Hash: 339bf0eb5f6bd763675b656cf29553fd3320f36d718162416a28d46bcae52b3d
Instruction Fuzzy Hash: B912CE75F00215DBDB60DF64D8806EEB7A2EF85320F24953AE8569B395DB34EC81CB90

Function 066BB283 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd7dbc2fb74dbe0a04fc49e7385d97833bba96a5cd74f1cc3001a3b17c55e55
Instruction ID: 5647fd218f6d0db4a121de006fdb2558dea3c3b2623bca3fd2c532dd67433ede
Opcode Fuzzy Hash: 2bd7dbc2fb74dbe0a04fc49e7385d97833bba96a5cd74f1cc3001a3b17c55e55
Instruction Fuzzy Hash: 87224970E10219DBDFA4DA68D4907EEB7B2EB8A310F249426E409DB395DE34DCC18B91

Function 066BAD28 Relevance: 10.4, Strings: 8, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066BAE9C
$dq, xrefs: 066BAEF4
$dq, xrefs: 066BAF00
$dq, xrefs: 066BAE55
$dq, xrefs: 066BAE49
$dq, xrefs: 066BAECB
$dq, xrefs: 066BAEA8
$dq, xrefs: 066BAED7

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: 347dacd389d07b55ad1e0dc5e340c227aafe111d120a14380daa54d1d1eb91d1
Instruction ID: 4d72174f0b17ebeef72bc68ce807bde65318d1d4035048276514927d3f638c0a
Opcode Fuzzy Hash: 347dacd389d07b55ad1e0dc5e340c227aafe111d120a14380daa54d1d1eb91d1
Instruction Fuzzy Hash: D3E17F30E10219CFCF55DFA8D5906EEB7B2FF89311F109529E80AAB355DB319986CB90

Function 066BB6A0 Relevance: 8.0, Strings: 6, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066BBC69
$dq, xrefs: 066BBC75
$dq, xrefs: 066BBC01
$dq, xrefs: 066BBC41
$dq, xrefs: 066BBC35
$dq, xrefs: 066BBC0D

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: aeca28dd2e1708b33c81cdc1703fa8a2ebdd0fbcb7b6af7f4c9e56d2d63db481
Instruction ID: 50655c2c6b836ecd801e962898953188b4cb9628c6161ca10b345beea538623b
Opcode Fuzzy Hash: aeca28dd2e1708b33c81cdc1703fa8a2ebdd0fbcb7b6af7f4c9e56d2d63db481
Instruction Fuzzy Hash: F5026A30E10219CFDBA4DF68D5806ADB7B2EB85310F24992AE405DB385DF74ED82CB91

Function 066B91A0 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066B921C
$dq, xrefs: 066B9257
$dq, xrefs: 066B9210
$dq, xrefs: 066B924B

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 66ce97dac272f74fe22bd5c267e57eb34c63051440b727f99839b9174455b76b
Instruction ID: d09e0e28230da45642a69a345cd3552b54245d262d26de21b5410302448f7a08
Opcode Fuzzy Hash: 66ce97dac272f74fe22bd5c267e57eb34c63051440b727f99839b9174455b76b
Instruction Fuzzy Hash: C9913D30B1021A9FDB54DB65D950BAFB7F6EB85300F108569D909EB388EF70DD828B91

Function 066BCFA8 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066BD3AF
$dq, xrefs: 066BD39B
$dq, xrefs: 066BD3A3

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq
API String ID: 0-2861643491
Opcode ID: dba792e0221bf4e5feefbfb5804b32573f33e54efac5eb7d1ef446caa0110b2b
Instruction ID: 51b7bddf69b40e5a3cb5a97fd3b9f7b371e4547d57fc05935cfbac733186afc5
Opcode Fuzzy Hash: dba792e0221bf4e5feefbfb5804b32573f33e54efac5eb7d1ef446caa0110b2b
Instruction Fuzzy Hash: B9625130A00216CFCB54EF68D990A9EB7F2FF85345B209969D4099F359DB71ED86CB80

Function 066B4BF0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Oiq, xrefs: 066B4DA7
XPiq, xrefs: 066B4D1D
fiq, xrefs: 066B52FD

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: fiq$XPiq$\Oiq
API String ID: 0-1639307521
Opcode ID: 933b9d5d77ec7b251b3fd972793c27ebddbef1a1f70a776cc1f80d3536e476ff
Instruction ID: 7c5d00a83c9a699d2a82ca3be189252f430c65ef049605da99441de95aa25e7f
Opcode Fuzzy Hash: 933b9d5d77ec7b251b3fd972793c27ebddbef1a1f70a776cc1f80d3536e476ff
Instruction Fuzzy Hash: 31616070F00219DFEB549FA5C8147AEBBF6EF89300F20852AE106AB395DF758C458B91

Function 066B9193 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 066B9210
$dq, xrefs: 066B924B

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 2b0c77aba27e502925fc0c0a1b17758c0b1d19aae76085c83dad9c38e61493c8
Instruction ID: f57e98525a1777625ea2da6401992f5a9dc5e7943f4cafa337f216d6a4ebdd6a
Opcode Fuzzy Hash: 2b0c77aba27e502925fc0c0a1b17758c0b1d19aae76085c83dad9c38e61493c8
Instruction Fuzzy Hash: D9517130B102099FDB54DB64D990BAF77F6EBC9700F108569D90ADB388EE71DD428B91

Function 00D0EB30 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2915778310.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d00000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24f87fe5a8d9db269724ed9177227b613353a3c14426576c083e2e23c1cb8df
Instruction ID: 1437a79f6eb41586ab648c5e1df4bc31084d16514903e79277fee39bad3736e4
Opcode Fuzzy Hash: b24f87fe5a8d9db269724ed9177227b613353a3c14426576c083e2e23c1cb8df
Instruction Fuzzy Hash: 5E412472D003999FCB10DFA9D8046EEBFF5EF99310F15866AD508A7281DB749845CBE0

Function 00D0EC18 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00D0EC7F

Memory Dump Source

Source File: 0000000D.00000002.2915778310.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d00000_aBYKwaZ.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 87a012559da0cb1e9925702c539c498416d3aff8d91d94e5467d33c57cc7ef99
Instruction ID: 7de4fb52dc6184fc87981d0fa57bbf398b68f481b2005952084aeb072b2ce518
Opcode Fuzzy Hash: 87a012559da0cb1e9925702c539c498416d3aff8d91d94e5467d33c57cc7ef99
Instruction Fuzzy Hash: F11120B1C006599BCB10DF9AC548BDEFBF4EF48320F15812AE818B7280D378A944CFA5

Function 066B4BE0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

XPiq, xrefs: 066B4D1D

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: XPiq
API String ID: 0-3497805733
Opcode ID: f244996493349f606704038d1c7d16ed33cee3e0076e978887b91303cdffcadd
Instruction ID: c5db070423e274369dd578bce2df67af01c8b9364d59be16d63417c2cc51d09c
Opcode Fuzzy Hash: f244996493349f606704038d1c7d16ed33cee3e0076e978887b91303cdffcadd
Instruction Fuzzy Hash: 65417270F002099FDB559FA9C814BAEBBF6FF89300F20852AE106AB395DF755C458B91

Function 066BDB15 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PHdq, xrefs: 066BDC71

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: c469a98ed69b410a08cd74ef0bc7c3313e030e6e5c0475ada22b20acd73d31ab
Instruction ID: a4d346a23dd67aacfe5c3dbcfbb077b0848db9eb069df8e290d6577817501b66
Opcode Fuzzy Hash: c469a98ed69b410a08cd74ef0bc7c3313e030e6e5c0475ada22b20acd73d31ab
Instruction Fuzzy Hash: 3E418E70E00749DFDB65DFA5C4947AEBBB6EF85300F20592AE405EB340DB70A982CB81

Function 066B2290 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHdq, xrefs: 066B23CB

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: 09fd820d2c412df12d4f750fc5498910789d652e92e5c2cc294b774b97e232a0
Instruction ID: f831a0ceade813279d7aebcf2a32a994e4f0e00aa284393c9433f926a50e1c3f
Opcode Fuzzy Hash: 09fd820d2c412df12d4f750fc5498910789d652e92e5c2cc294b774b97e232a0
Instruction Fuzzy Hash: 2E318F30B00205DFDB55AB74C5647AF7BEAAF89200F205429D406DB395DF75DE82CBA1

Function 066B6248 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08517fe2c6cdea28bb8e39a0a920548f5f5fe09e78b59814ac8e8701895f4bf9
Instruction ID: 0ac796abf7f957d71ec9ce7c95fa54d43fc148a66e7df6097e4335fe66a2f7bb
Opcode Fuzzy Hash: 08517fe2c6cdea28bb8e39a0a920548f5f5fe09e78b59814ac8e8701895f4bf9
Instruction Fuzzy Hash: 1E618F71F001218FDF549A6DC8806AFAADBEFD5220B254439E80EDB364DE75ED8287D1

Function 066B4321 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69ede33211646b9d1c865d21412bd9b645bbdf3293b2a48dd8f3c749af11cf8
Instruction ID: 11c2a5af9a83985ae14fa7edc4eca1cdf99e4a296f04ab24e152950fc00820ca
Opcode Fuzzy Hash: b69ede33211646b9d1c865d21412bd9b645bbdf3293b2a48dd8f3c749af11cf8
Instruction Fuzzy Hash: 2A814D30B006099FDF54DFA9D59469EBBF6EB89300F108529D40ADB399EF30DC828B91

Function 066B4640 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334e8c0f2d5ad1565668241b6b044d4ebc43ce723d8f2f7b428d3667d523222d
Instruction ID: e06a82c8b7acdd9bf99a62843ea90c8da3ffe7387be33dce8df0ea343a0aa87f
Opcode Fuzzy Hash: 334e8c0f2d5ad1565668241b6b044d4ebc43ce723d8f2f7b428d3667d523222d
Instruction Fuzzy Hash: 59913E30E002599FDF60DF68C850BDDB7B1FF89310F20859AD549AB395DB70AA85CB91

Function 066B4658 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6b6a1cfba36876fdaad796206fe2dc5bca9d85d81004085fbd0bfe1fd5e490
Instruction ID: a71ca1a69713d69119e8c00e10fe4651f9830a25e0d193a4883a8b51518f1125
Opcode Fuzzy Hash: bf6b6a1cfba36876fdaad796206fe2dc5bca9d85d81004085fbd0bfe1fd5e490
Instruction Fuzzy Hash: 77912B70E102199BDF60DF68C850BDDB7B1FF89310F208599E54DAB395EB70AA858B90

Function 066BEB68 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168a97ab31a0646473781f571730d5fa7ecf30ffdc5ba143e004e93cc6d0631b
Instruction ID: 0af27946d8304cbc9dd88353d634368ac07efd6f0d6853e1a39e2e625d644ec4
Opcode Fuzzy Hash: 168a97ab31a0646473781f571730d5fa7ecf30ffdc5ba143e004e93cc6d0631b
Instruction Fuzzy Hash: 3E713C74E002089FCB54DFA8D990ADEBBF6FF88300F149429E40A9B355DB71E986CB50

Function 066BEB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14eb1fb76635ee8da117909f9b79544179cf9ce88dd33bdfc3368bfc54b55678
Instruction ID: 31236c9346ae7d22a4df6bb8fe833d2102fd0164316260b94cc7dfdea00711c7
Opcode Fuzzy Hash: 14eb1fb76635ee8da117909f9b79544179cf9ce88dd33bdfc3368bfc54b55678
Instruction Fuzzy Hash: 04711B70A002099FCB54DFA8D990ADEBBF6EF88340F149529E409DB355DB71ED86CB50

Function 066BFCD9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcd3dd392bc3540b480e83aa86721eb89b4ae949ef5d167df5acf515c1d6712
Instruction ID: 50a9405f8432eae16367299d93d98aa0bb418e24fb017d0f1ff29ca2ab387af5
Opcode Fuzzy Hash: 7fcd3dd392bc3540b480e83aa86721eb89b4ae949ef5d167df5acf515c1d6712
Instruction Fuzzy Hash: C751D231E00105DFDB64EB78EC947EDBBB2EB84315F20886AE106D7361DB318996CB81

Function 066BFA88 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a3ee334d8abafc472562286d16f5f8a05513942fb729e6b7c72d5980119050
Instruction ID: 65f013dd839b4cf8b1d7bb512db5ecda6eabefb36c0d6b2b31ab41f20c67a1e1
Opcode Fuzzy Hash: 07a3ee334d8abafc472562286d16f5f8a05513942fb729e6b7c72d5980119050
Instruction Fuzzy Hash: 6351C470B20214DBEF64666CDC907AF269AE789311F20452AE50EC73A5CF3DCCC257A2

Function 066BFA98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f0aa4f33408b8736d5258c91a06da766741020ee890d8bb775e80343cdb9d4
Instruction ID: 9d9d9208326f1eda82b1ee97da74ebc8719af578217d45018dd3e878e90e74b0
Opcode Fuzzy Hash: 84f0aa4f33408b8736d5258c91a06da766741020ee890d8bb775e80343cdb9d4
Instruction Fuzzy Hash: AF51B470B20214DBEF64666CDC947AF269AE789351F20452AE50EC33A5CF7DCCC257A2

Function 066B5499 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b119b0a68736543a08b05e0686092c1afc82f809bc56c5e24636f37285662696
Instruction ID: fb13f2084fca5e8ce1a0578368d47f3f628052c05dc50f52c6a5dcbefe4cad73
Opcode Fuzzy Hash: b119b0a68736543a08b05e0686092c1afc82f809bc56c5e24636f37285662696
Instruction Fuzzy Hash: C1416072E00609CFDF70CEA9D881AEFFBB2EB45311F10492AE156D7250D330E9958B95

Function 066B5618 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04280bb9bb36174ba45a723dd4816cff8a45f0209a45d6f7df66ccc33298bff8
Instruction ID: 97ec83e62da28ee11e5d1ca94b549f79c693af4b6cfe774aead96c90efaf23a9
Opcode Fuzzy Hash: 04280bb9bb36174ba45a723dd4816cff8a45f0209a45d6f7df66ccc33298bff8
Instruction Fuzzy Hash: C2419D75E00205CBDB618F69C480AFEFBB2FB45310F24D92AE55ADB391D634E981CB91

Function 066B2140 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a374de075843b741ee88a4e3061159bd69226182591ddc4d003d558307f3c1
Instruction ID: 05611360159f2a921bdd9d7360c18fd8f8a52131f629739afdcad8d68610eaaf
Opcode Fuzzy Hash: 66a374de075843b741ee88a4e3061159bd69226182591ddc4d003d558307f3c1
Instruction Fuzzy Hash: 54316E30E102059FCB55CF64C8A4AEEB7F6EF89310F148529E906EB754DB71AD82CB40

Function 066B2150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f47489db10dc393a9f773fc0398baa64ea1c74cc0ed4f28aa581156c0760f7
Instruction ID: aa3ab6932cd1cb340cba7a21cd54e9ff1f0e207076a0c389acdd6f56ed8b5733
Opcode Fuzzy Hash: f4f47489db10dc393a9f773fc0398baa64ea1c74cc0ed4f28aa581156c0760f7
Instruction Fuzzy Hash: 00315E30E10606DFCB55DF65C8A4AAEB7F6EF89300F148529E906EB354DB71AD82CB50

Function 066B3B21 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752bd319ea0da7d11379180fb6f9720a50148df46e93b096df3fc6c5c7b0e7a7
Instruction ID: 5103da03667aa8b83e9a4f4eb42b5e1d714a13384aa86c776d68c05b8c5b5062
Opcode Fuzzy Hash: 752bd319ea0da7d11379180fb6f9720a50148df46e93b096df3fc6c5c7b0e7a7
Instruction Fuzzy Hash: 55219C34F016149FDB40DF68E980AEEBBF5EB48710F008029E905E7358E730D8828BA0

Function 066B3B30 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3097fca450992a91ab704c2bdf3d7d289ffd36804dc68fbd29c1989566eb662f
Instruction ID: 6d3ccc77ac38c238a00e79f06a627790059612198389d036faeeff6c46a1b8b9
Opcode Fuzzy Hash: 3097fca450992a91ab704c2bdf3d7d289ffd36804dc68fbd29c1989566eb662f
Instruction Fuzzy Hash: 04219A35F016159FDB40DFA9D980AEEBBF1EB88310F108529E906E7358E734D841CB90

Function 00CBD005 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2915430645.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b42aa3d90c706331691f89a50c0d48b63acc8c339ca0d6c15d51483f5942568
Instruction ID: ab822c70bcf3b4f4d0ce501636305f202a97820af8c0a801b2abaa81aa9b0742
Opcode Fuzzy Hash: 8b42aa3d90c706331691f89a50c0d48b63acc8c339ca0d6c15d51483f5942568
Instruction Fuzzy Hash: 45314F3554E3C09FDB03DB24D9A4745BF71AB47214F19C5DBD8898F1A3C23A980ACB62

Function 00CBD20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2915430645.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629b888e0340448f940ffcf1e997c4f91bd9bf2fcec9fedac615d21f06f2a369
Instruction ID: f9f7be98648d798cdc149a45c6334ce9ef7aca30d843d0d64f7b45bccc3e8b1a
Opcode Fuzzy Hash: 629b888e0340448f940ffcf1e997c4f91bd9bf2fcec9fedac615d21f06f2a369
Instruction Fuzzy Hash: 7B2123B1604384EFDB05DF14D9C4B66BBA5FB94324F24C669E80B0B241D37ADC06CB62

Function 00CBD3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2915430645.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a7f66b545fa66f9898f123c89097007e8f86cf2ae9cf538d3211e1fd1584d2
Instruction ID: 0e6751c46b44e125458bf9d903834c3b2807a77b9034ddf8992a9024f71d1b3c
Opcode Fuzzy Hash: b2a7f66b545fa66f9898f123c89097007e8f86cf2ae9cf538d3211e1fd1584d2
Instruction Fuzzy Hash: 9C21F575604204DFCB04DF14D5C4B66BBA5FB94314F24C96DD90B4B292D376E846CE61

Function 00CBD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2915430645.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54575ec934fe138807b95fe64692ed87f50475d7f811bad752f6059776a78874
Instruction ID: 9e3d26909494def42f96686be870a856ff739b9caab6b70e88b7d0200ae293e9
Opcode Fuzzy Hash: 54575ec934fe138807b95fe64692ed87f50475d7f811bad752f6059776a78874
Instruction Fuzzy Hash: 81210771604204DFCB14EF14E9C4B66BBA5FB94314F24C96DE84B4B341D73AD846CB62

Function 066B6D70 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ded8d760558fff339d218b07b851fb2d690998c2004f02c53d4ad0dfa04f02
Instruction ID: e05896405aac6020e6326d579976a8753d4f6102b67546f614dd0a151a5ab44d
Opcode Fuzzy Hash: 07ded8d760558fff339d218b07b851fb2d690998c2004f02c53d4ad0dfa04f02
Instruction Fuzzy Hash: 4F217F30B10119DBDF94EA69E9547EEBBB6EBC4310F249429E405DB344DB31ED928BC4

Function 066B4280 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c862380cf3266f7bcd34cd65c8e22be8553eecca9e002f0506c2743f757d9a0
Instruction ID: 10b79229c2c7810fbb66fcb1ab687ad1481d317805b7466b77daf7a12ad59e94
Opcode Fuzzy Hash: 1c862380cf3266f7bcd34cd65c8e22be8553eecca9e002f0506c2743f757d9a0
Instruction Fuzzy Hash: 4911F530B041104FDB619ABDC454B6FBBD6DBC6710F18887AF10ACB34ADD21DC824391

Function 066B3C40 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383b5006179dc2bb21835693cce4a64d42fa320492caa24fa05d06de5f614499
Instruction ID: e2600e795aa62607854c5d5b2c0684f8f78b9228a0bcb418919ac75db7d8538a
Opcode Fuzzy Hash: 383b5006179dc2bb21835693cce4a64d42fa320492caa24fa05d06de5f614499
Instruction Fuzzy Hash: 8A118E31B040289FDB849AA8D8106EF77EBEBC8610F108139C90AE7354EF74DC128BD1

Function 066B38F8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0fed3332a5abf974de64f6bd4bd19f5205cfd9e23334d81f391aefb42e98fa
Instruction ID: 35ebdd5aa8fdc9e6f45eb93492c2e3fe3a8bedb65fa2e2a04fee327e989abad0
Opcode Fuzzy Hash: 1d0fed3332a5abf974de64f6bd4bd19f5205cfd9e23334d81f391aefb42e98fa
Instruction Fuzzy Hash: 3E21D0B5901659ABCB10DF9AD885ACEFFB8FB49310F10822AE918B3340D774A554CBA5

Function 066BA357 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b702130b3662121c5319d91f5c807d3e30afe59fa785e94bc848720396e6f1fe
Instruction ID: e0ff2c5cd0aa4a9de70f738c7cbe7706758f82fc86d0428802ceceabf9de83a2
Opcode Fuzzy Hash: b702130b3662121c5319d91f5c807d3e30afe59fa785e94bc848720396e6f1fe
Instruction Fuzzy Hash: 07012430B002108FC761AA78D968B9F77E6EB8A710F10882AF10ACB354EE21DC428391

Function 066BEDE9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e954183f0640e725b1652a088f9ad1b582505595f79d23eb89987ff1afad7167
Instruction ID: 537f1c2ec641e34b864174100bea1ca025ecf95e60f110a63897e4a828663599
Opcode Fuzzy Hash: e954183f0640e725b1652a088f9ad1b582505595f79d23eb89987ff1afad7167
Instruction Fuzzy Hash: 3601F231F141504FCBA19A7DD864BAFB7E6DBC9620F14882AF60ACB342DA62DD4243D5

Function 00CBD207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2915430645.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction ID: 23a19dc15253aface27461c4e54e6c2ab344166efa1feced8e7dca4c2f0828da
Opcode Fuzzy Hash: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction Fuzzy Hash: 73119D76504284DFDB12CF14D5C4B56BB61FB84324F24C6AAD84A4B656C33AD90ACBA2

Function 00CBD3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2915430645.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cbd000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: b15c80abd521a4a973ae49cce5b5111d580eda646896a17042faa243c94a4eca
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 2C118B75504280DFDB05CF14D5C4B55BBA2FB84324F24C6AAD84A4B696C33AE94ACFA1

Function 066B3C2F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34667e3a79d6df5a4a5588bb9cfb4f5cdffaa5e1394c123c3440961272a63b1a
Instruction ID: 4fc3d6f1ba10bf13c1c04bedda3766cbf78b11aad9ac89664a9665fc8f9e9cc8
Opcode Fuzzy Hash: 34667e3a79d6df5a4a5588bb9cfb4f5cdffaa5e1394c123c3440961272a63b1a
Instruction Fuzzy Hash: EC01B131B140286BDB949AA9D8106EF7AABDBC9610F10413AD50AE7344EF60CC0247D1

Function 066B3900 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b047484745467f1b6b1c35a2e6e80963f4541ee7584c2f0d423da5781d4c74
Instruction ID: 4df9d91c4bee6f242fd1695784663e0b70a66ce93d0a691c4f753dcc986c0232
Opcode Fuzzy Hash: 38b047484745467f1b6b1c35a2e6e80963f4541ee7584c2f0d423da5781d4c74
Instruction Fuzzy Hash: E411CEB1D01259ABCB00DF9AD884ACEFBB4FB48310F10822AE918B7340D374A954CBA5

Function 066B4290 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ca99896a949e3ee9ea49ba8efffb3f27cdb3befb2db79364c4c57e08273a42
Instruction ID: 4cd10f011e268abda683151be59d30f4dbba947066621cd48e9de0088ec2bfd6
Opcode Fuzzy Hash: 62ca99896a949e3ee9ea49ba8efffb3f27cdb3befb2db79364c4c57e08273a42
Instruction Fuzzy Hash: F9018135B101204BDBA49AADD454B6FB7DADBC9B20F14883AF10AC734ADD61DC824395

Function 066BFF2B Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec548876ac7543544d567eb50fb20fe86bd234b6bc26b2654cf5ae86bf5e1b06
Instruction ID: 9899de533e6ca42ad70a68983d89505ccc35f8d2bc2cde79fe6e982c23754bac
Opcode Fuzzy Hash: ec548876ac7543544d567eb50fb20fe86bd234b6bc26b2654cf5ae86bf5e1b06
Instruction Fuzzy Hash: 28010470A083448FDB91DB78EC107EEBBF5EB86204F1041AAD448D7296EB309941CB92

Function 066BEDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ff44ad266aa01d59088eec69a07239619bbca0a4f4e7930d364244e5e7c121
Instruction ID: 138def2d2423d2459005347104469210fa3a0f5ddf0c39c02101bf7340be1d13
Opcode Fuzzy Hash: a1ff44ad266aa01d59088eec69a07239619bbca0a4f4e7930d364244e5e7c121
Instruction Fuzzy Hash: A1018C31F100118BCBA49A7DD464BAF63D6DBC9A61F10882AF20AC7345DE62DC434395

Function 066BA368 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64b8aedfec4f09b9435ca0f693a80684b8ac1a0f53860fd09d083ed9ba762a2
Instruction ID: c948d4b6042406a2835b9ce2aa2997f40ecdcf32d60c03bb12da36f6f2a162fa
Opcode Fuzzy Hash: a64b8aedfec4f09b9435ca0f693a80684b8ac1a0f53860fd09d083ed9ba762a2
Instruction Fuzzy Hash: 30014431F105148FDB90EA6DD564B6F73D6E78A711F108829F50BCB354EE21DD428790

Function 066BFF48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16256ec47113961e946c863027caac288dfbe6e0a958ad042ffe2c4041970b2
Instruction ID: d804a7ff101cbba785042da8f72eeb5e89afb310ddfdd0db9cf29398e718e54c
Opcode Fuzzy Hash: d16256ec47113961e946c863027caac288dfbe6e0a958ad042ffe2c4041970b2
Instruction Fuzzy Hash: 19F05EB4A002058FD780EB7888512AEBBF6EB89201F1041799409D3259EB709942CBE1

Function 066B64C9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc548ce4dfac49bafa4dfaf8abeeb24d5265c2290165c95048ea7281aa0004c
Instruction ID: a1c7297413e9c82994f75a073aaf7ebc7b3551071e675dc481b3f88ead526d72
Opcode Fuzzy Hash: 7bc548ce4dfac49bafa4dfaf8abeeb24d5265c2290165c95048ea7281aa0004c
Instruction Fuzzy Hash: 4FE09B71E15285E7DB61DE74D95578A7BB9D701204F20C8B6D404C7242E576DA818391

Non-executed Functions

Function 066B76F8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$dq, xrefs: 066B7C50
$dq, xrefs: 066B77E8
$dq, xrefs: 066B7C44
$dq, xrefs: 066B7819
$dq, xrefs: 066B7825
$dq, xrefs: 066B7C66
$dq, xrefs: 066B7BB1
$dq, xrefs: 066B77F4
$dq, xrefs: 066B7C5A
$dq, xrefs: 066B7BA5

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3623093008
Opcode ID: af776a4618215e7f2a80b7e974515b3e96ac866420c46390e36c796a55b27a53
Instruction ID: b40de5886aced54e037fbb342a7b0f3234560c22bdf5985c67150d22ca0ee415
Opcode Fuzzy Hash: af776a4618215e7f2a80b7e974515b3e96ac866420c46390e36c796a55b27a53
Instruction Fuzzy Hash: 7012F970E01219CFDB64DF65D954AAEBBB2FF88301F209569D40AAB365DB309D81CF90

Function 066BA990 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$dq, xrefs: 066BAAE1
$dq, xrefs: 066BAA86
$dq, xrefs: 066BAA92
$dq, xrefs: 066BAB18
$dq, xrefs: 066BAB0C
$dq, xrefs: 066BAAED
$dq, xrefs: 066BAB42
$dq, xrefs: 066BAB4E

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: 7768890bd12d036244f12f0d62c26f27f075f0bbacfbe065cdaabca47e2a7e47
Instruction ID: 7246299ea7a7e7fcb83a4e7e827f81301bb3d83d3a2f33e9342ee40159d2dc94
Opcode Fuzzy Hash: 7768890bd12d036244f12f0d62c26f27f075f0bbacfbe065cdaabca47e2a7e47
Instruction Fuzzy Hash: 17917030A10309DFDB64EFA4D995BAE7BB2EF44301F209529E4069B395DB359D82CB90

Function 066B70F8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$dq, xrefs: 066B7594
$dq, xrefs: 066B7440
$dq, xrefs: 066B7434
$dq, xrefs: 066B73DA
.5|q, xrefs: 066B7153
$dq, xrefs: 066B7600
$dq, xrefs: 066B760C

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: .5|q$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3447281907
Opcode ID: 72c8b9fb770dbb35f7b8727a0e80312bd0d429496e677f35fef0705753067e8b
Instruction ID: 03f026d87e8e46481c46dada3c8f6753d35836c50aa457f63c02e4959976105c
Opcode Fuzzy Hash: 72c8b9fb770dbb35f7b8727a0e80312bd0d429496e677f35fef0705753067e8b
Instruction Fuzzy Hash: 40F11D30A01209DFDB54EF69D594BAEBBB2FF84301F248569D40A9B399DB35DC82CB50

Function 066B8428 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$dq, xrefs: 066B8682
$dq, xrefs: 066B86E7
$dq, xrefs: 066B868E
$dq, xrefs: 066B86F3

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: e19ed3803bcb3ffb22c577b328e892e0f9cbbe08b3249a7c55d63387262e3311
Instruction ID: 9a8fd6279cae7043e11846002b6a1ca2fa9471447da82b2d598ed0c8832a42d9
Opcode Fuzzy Hash: e19ed3803bcb3ffb22c577b328e892e0f9cbbe08b3249a7c55d63387262e3311
Instruction Fuzzy Hash: A3B15B30A10218CFDB54EF69C59079EBBB6EF84305F24982DE40A9B395DB74DC82CB90

Function 066B8840 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRdq, xrefs: 066B8933
LRdq, xrefs: 066B8982
$dq, xrefs: 066B88CB
$dq, xrefs: 066B88BF

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: LRdq$LRdq$$dq$$dq
API String ID: 0-340319088
Opcode ID: 6a88ea5356cb61b5524d2c6c7dc94314f34d85a67eda198a88e741d7f172f292
Instruction ID: 9cd54427e5cd25939638de7dee61dd2dfd4dc790e63d5b7efc7bcd0a02f5a327
Opcode Fuzzy Hash: 6a88ea5356cb61b5524d2c6c7dc94314f34d85a67eda198a88e741d7f172f292
Instruction Fuzzy Hash: 7151A430B00205DFDB54EB28D990AAA77E6FF85314F14996DE4169B395DB30EC81CB91

Function 066BAD18 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$dq, xrefs: 066BAE9C
$dq, xrefs: 066BAEF4
$dq, xrefs: 066BAE49
$dq, xrefs: 066BAECB

Memory Dump Source

Source File: 0000000D.00000002.2934787894.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_66b0000_aBYKwaZ.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 6f037d03ea351a441707467942e1b9a6bfcbb6b648d60c8faeaaae1ee6a9a608
Instruction ID: c68353a6e24a3fa961dbf12b05f6cb2d49ce57b5886eab152dc4a7d0bb86e92f
Opcode Fuzzy Hash: 6f037d03ea351a441707467942e1b9a6bfcbb6b648d60c8faeaaae1ee6a9a608
Instruction Fuzzy Hash: EC51A530E11204DFDFA5EBA4E5906EE77B6EB89311F109529E806DB345DB31DC82CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IMG 003.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IMG 003.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aBYKwaZ.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vem45lg.t4g.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwpm1dt0.imr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebl22nai.0ne.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ld2svign.kwg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxg52aaw.l3b.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qvak2ews.kq2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdcq5x5s.e4t.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ttongutp.2v3.ps1

C:\Users\user\AppData\Local\Temp\tmp170F.tmp

Windows Analysis Report
IMG 003.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre